Medium severity5.4NVD Advisory· Published Sep 25, 2020· Updated Jun 17, 2026
CVE-2020-15198
CVE-2020-15198
Description
In Tensorflow before version 2.3.1, the SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has the same shape as the values one. The values in these tensors are always accessed in parallel. Thus, a shape mismatch can result in accesses outside the bounds of heap allocated buffers. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tensorflowPyPI | >= 2.3.0, < 2.3.1 | 2.3.1 |
tensorflow-cpuPyPI | >= 2.3.0, < 2.3.1 | 2.3.1 |
tensorflow-gpuPyPI | >= 2.3.0, < 2.3.1 | 2.3.1 |
Affected products
6- Range: >= 2.3.0, < 2.3.1
- ghsa-coords4 versions
>= 2.3.0, < 2.3.1+ 3 more
- (no CPE)range: >= 2.3.0, < 2.3.1
- (no CPE)range: >= 2.3.0, < 2.3.1
- (no CPE)range: >= 2.3.0, < 2.3.1
- (no CPE)range: >= 2.3.0, < 2.3.1
Patches
Vulnerability mechanics
References
8- github.com/tensorflow/tensorflow/commit/3cbb917b4714766030b28eba9fb41bb97ce9ee02nvdPatchThird Party AdvisoryWEB
- github.com/tensorflow/tensorflow/security/advisories/GHSA-jc87-6vpp-7ff3nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-jc87-6vpp-7ff3ghsaADVISORY
- github.com/tensorflow/tensorflow/releases/tag/v2.3.1nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2020-15198ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-278.yamlghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-313.yamlghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-121.yamlghsaWEB
News mentions
0No linked articles in our index yet.