ghsa

### Impact If `QuantizeAndDequantizeV3` is given a nonscalar `num_bits` input tensor, it results in a `CHECK` fail that can be used to trigger a denial of service attack. ```python import tensorflow as tf signed_input = True range_given = False narrow_range = False axis = -1 input = tf.constant(-3.5, shape=[1], dtype=tf.float32) input_min = tf.constant(-3.5, shape=[1], dtype=tf.float32) input_max = tf.constant(-3.5, shape=[1], dtype=tf.float32) num_bits = tf.constant([], shape=[0], dtype=tf.int32) tf.raw_ops.QuantizeAndDequantizeV3(input=input, input_min=input_min, input_max=input_max, num_bits=num_bits, signed_input=signed_input, range_given=range_given, narrow_range=narrow_range, axis=axis) ``` ### Patches We have patched the issue in GitHub commit [f3f9cb38ecfe5a8a703f2c4a8fead434ef291713](https://github.com/tensorflow/tensorflow/commit/f3f9cb38ecfe5a8a703f2c4a8fead434ef291713). The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1...

### Impact If `RaggedTensorToVariant` is given a `rt_nested_splits` list that contains tensors of ranks other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. ```python import tensorflow as tf batched_input = True rt_nested_splits = tf.constant([0,32,64], shape=[3], dtype=tf.int64) rt_dense_values = tf.constant([0,32,64], shape=[3], dtype=tf.int64) tf.raw_ops.RaggedTensorToVariant(rt_nested_splits=rt_nested_splits, rt_dense_values=rt_dense_values, batched_input=batched_input) ``` ### Patches We have patched the issue in GitHub commit [88f93dfe691563baa4ae1e80ccde2d5c7a143821](https://github.com/tensorflow/tensorflow/commit/88f93dfe691563baa4ae1e80ccde2d5c7a143821). The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://githu...

### Impact If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. ```python import tensorflow as tf num_bits = 8 narrow_range = False inputs = tf.constant(0, shape=[4], dtype=tf.float32) min = tf.constant([], shape=[4,0,0], dtype=tf.float32) max = tf.constant(0, shape=[4], dtype=tf.float32) tf.raw_ops.FakeQuantWithMinMaxVarsPerChannel(inputs=inputs, min=min, max=max, num_bits=num_bits, narrow_range=narrow_range) ``` ### Patches We have patched the issue in GitHub commit [785d67a78a1d533759fcd2f5e8d6ef778de849e0](https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0). The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. ### For more information Please consult [our security guid...

## Overview The issue lies in the implementation of the `cell_project` macro which used `field as *const _` instead of `field as *mut _`. The problem being that `*const T` is covariant in `T` while `*mut T` is invariant in `T`. Keep in mind that `&Cell<T>` is invariant in `T`, so casting to `*const T` relaxed the variance, and lead to unsoundness, as shown in the example below. ```rs use std::cell::Cell; use cell_project::cell_project as cp; struct Foo<'a> { x: Option<&'a Cell<Foo<'a>>>, } impl<'a> Drop for Foo<'a> { fn drop(&mut self) { // `ourselves` is an &Cell<Self>. // NB: `Drop` is unsound. if let Some(ourselves) = self.x.as_ref() { // replace `self` (but this doesn't actually replace `self`) let is_x_none = ourselves.replace(Foo { x: None, }).x.as_ref().is_none(); // if we just moved out of `self`, and we had a `Some` originally, // how come this is a `None`? ...

### Impact When converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process. ```python import tensorflow as tf class QuantConv2DTransposed(tf.keras.layers.Layer): def build(self, input_shape): self.kernel = self.add_weight("kernel", [3, 3, input_shape[-1], 24]) def call(self, inputs): filters = tf.quantization.fake_quant_with_min_max_vars_per_channel( self.kernel, -3.0 * tf.ones([24]), 3.0 * tf.ones([24]), narrow_range=True ) filters = tf.transpose(filters, (0, 1, 3, 2)) return tf.nn.conv2d_transpose(inputs, filters, [*inputs.shape[:-1], 24], 1) inp = tf.keras.Input(shape=(6, 8, 48), batch_size=1) x = tf.quantization.fake_quant_with_min_max_vars(inp, -3.0, 3.0, narrow_range=True) x = QuantConv2DTransposed()(x) x = tf.quantization.fake_quant_with_min_max_vars(x, -3.0, 3.0, narrow_range=True) model = tf.keras.Model(inp, x) model.save("/tmp/testing") convert...

### Impact SFTPGo WebAdmin and WebClient support login using TOTP (Time-based One Time Passwords) as a seconday authentication factor. Because TOTPs are often configured on mobile devices that can be lost, stolen or damaged, SFTPGo also supports recovery codes. These are a set of one time use codes that can be used instead of the TOTP. In SFTPGo versions from v2.2.0 to v2.3.3 recovery codes can be generated before enabling two-factor authentication. An attacker who knows the user's password could potentially generate some recovery codes and then bypass two-factor authentication after it is enabled on the account at a later time. ### Patches Fixed in v2.3.4. Recovery codes can now only be generated after enabling two-factor authentication and are deleted after disabling it. ### Workarounds Regenerate recovery codes after enabling two-factor authentication. ### References https://github.com/drakkan/sftpgo/issues/965

### Impact It's possible to perform a CSRF attack for adding or removing tags on XWiki pages. ### Patches The problem has been patched in XWiki 13.10.5 and 14.3. ### Workarounds It's possible to fix the issue without upgrading by locally modifying the documentTags.vm template in your filesystem, to apply the changes exposed there: https://github.com/xwiki/xwiki-platform/commit/7ca56e40cf79a468cea54d3480b6b403f259f9ae. ### References https://jira.xwiki.org/browse/XWIKI-19550 ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki](https://jira.xwiki.org) * Email us at [security ML](mailto:[email protected])

### Impact The [`ScatterNd`](https://github.com/tensorflow/tensorflow/blob/266558ac4c1f361e9a178ee9d3f0ce2e648ae499/tensorflow/lite/kernels/internal/reference/reference_ops.h#L659-L698) function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. ### Patches We have patched the issue in GitHub commit [b4d4b4cb019bd7240a52daa4ba61e3cc814f0384](https://github.com/tensorflow/tensorflow/commit/b4d4b4cb019bd7240a52daa4ba61e3cc814f0384). The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with i...

### Impact The [`GatherNd`](https://github.com/tensorflow/tensorflow/blob/f463040eb3997e42e60a2ffc6dc72de7ef11dbb4/tensorflow/lite/kernels/gather_nd.cc#L105-L111) function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. ### Patches We have patched the issue in GitHub commit [595a65a3e224a0362d7e68c2213acfc2b499a196](https://github.com/tensorflow/tensorflow/commit/595a65a3e224a0362d7e68c2213acfc2b499a196). The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. ### Attribution This vu...

This issue and vector is similar to [RUSTSEC-2020-0029] of `rgb` crate which `mozjpeg` depends on. Affected versions of `mozjpeg` crate allow creating instances of any type `T` from bytes, and do not correctly constrain `T` to the types for which it is safe to do so. Examples of safety violation possible for a type `T`: * `T` contains a reference type, and it constructs a pointer to an invalid, arbitrary memory address. * `T` requires a safety and/or validity invariant for its construction that may be violated. The issue was fixed in 0.8.19 by using safer types and involving `rgb` dependency bump. [RUSTSEC-2020-0029]: https://rustsec.org/advisories/RUSTSEC-2020-0029.html