CVE-2021-37675: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, was found to contain a division by zero vulnerability in most convolution operators (CVE-2021-37675). The vulnerability was discovered in versions prior to 2.6.0 and was patched in versions 2.3.4, 2.4.3, and 2.5.1. The issue was reported by Yakun Zhang of Baidu Security and disclosed on August 11, 2021 (GitHub Advisory).

The vulnerability exists in the shape inference implementation of convolution operators, which lacks proper validation before performing divisions and modulo operations. An attacker can trigger a denial of service via a crash by exploiting missing validations in the shape inference implementation. The issue can be demonstrated using specific TensorFlow operations with zero-sized tensors (GitHub Advisory).

The vulnerability allows an attacker to trigger a denial of service condition by causing the application to crash through division by zero operations in the convolution operators (GitHub Advisory).

The vulnerability was patched in GitHub commit 8a793b5d7f59e37ac7f3cd0954a750a2fe76bad4 and included in TensorFlow versions 2.6.0, 2.5.1, 2.4.3, and 2.3.4. Users are advised to upgrade to these patched versions to mitigate the vulnerability (GitHub Advisory).