CVE-2021-41205: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, was found to contain a vulnerability (CVE-2021-41205) in the shape inference functions for the QuantizeAndDequantizeV* operations. The vulnerability could trigger a read outside of bounds of heap allocated array. This issue affected versions prior to 2.7.0, and the fix was included in TensorFlow versions 2.4.4, 2.5.2, 2.6.1, and 2.7.0 (GitHub Advisory).

The vulnerability occurs when the axis parameter in QuantizeAndDequantizeV* operations is set to a negative value different from -1 (the special value used for optional/unknown dimensions). The code failed to properly validate these negative values, leading to potential heap out-of-bounds read. The issue has a CVSS v3.1 Base Score of 7.1 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (NVD).

The vulnerability could lead to a read outside of bounds of heap allocated array, potentially exposing sensitive information. The CVSS score indicates high impacts on confidentiality and availability, while having no impact on integrity (NVD).

The issue was patched in GitHub commit 7cf73a2274732c9d82af51c2bc2cf90d13cd7e6d and included in TensorFlow versions 2.4.4, 2.5.2, 2.6.1, and 2.7.0. Users are advised to upgrade to these patched versions (GitHub Advisory).