CVE-2021-29617

Crash in `tf.strings.substr` due to `CHECK`-fail

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via `CHECK`-fail in `tf.strings.substr` with invalid arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

We have discovered 25 live websites that are affected by CVE-2021-29617.

Run a Free Instant Scan



Affected Software

Product  tensorflow
Category JavaScript Libraries
Vulnerable Domains25 live websites (6.98% of tensorflow install base)
Vulnerable Versions
  • from 0 through 2.1.4
  • from 2.2 through 2.2.3
  • from 2.3 through 2.3.3
  • from 2.4 through 2.4.2
Vulnerable Versions Count4 versions ( 57% of all versions)


Common Weakness Enumeration

CWE-755 Improper Handling of Exceptional Conditions



Details

  • Published - May 14, 2021
  • Updated - Aug 3, 2024

Website Distribution by Country

Number of websites using CVE-2021-29617
United States17 websites


Germany2 websites
India2 websites
Brazil1 websites
Canada1 websites
Korea, South1 websites
Netherlands1 websites

Website Distribution by TLD

Number of websites using CVE-2021-29617
.com14 websites
.net2 websites
.com.br1 websites
.org1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2021-29617

Top websites that are affected by CVE-2021-29617. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
************.com United States***,***
************.com United States***,***
******.me United States*,***,***
***********.com United States*,***,***
************.com United States*,***,***
****.net United States*,***,***
***********.com United States*,***,***
*******.**.kr Korea, South*,***,***
**********.com Netherlands*,***,***
********.app United States*,***,***
See full domain list

FAQ

CVE-2021-29617 is Improper Handling of Exceptional Conditions in tensorflow
A total of 25 websites have been identified as vulnerable to CVE-2021-29617, based on global website indexing conducted by WebTechSurvey.
The tensorflow is affected by the CVE-2021-29617 vulnerability.
tensorflow versions up to 2.4.2 are vulnerable to CVE-2021-29617.
CVE-2021-29617 is resolved in version 2.4.2 of tensorflow.