CVE-2022-35993: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, was found to contain a vulnerability (CVE-2022-35993) that was disclosed on July 15, 2022. The vulnerability affects TensorFlow versions prior to 2.10.0, specifically impacting versions 2.7.x, 2.8.x, and 2.9.x. The issue occurs in the SetSize operation when it receives an input set_shape that is not a 1D tensor (GitHub Advisory).

The vulnerability exists in TensorFlow's SetSize operation where improper validation of input parameters could lead to a CHECK failure. Specifically, when the set_shape parameter is provided with a non-1D tensor input, the operation fails to properly validate this input, resulting in a CHECK failure. The vulnerability has been assigned a Low severity rating (GitHub Advisory).

When exploited, this vulnerability can be used to trigger a denial of service attack against applications using the affected TensorFlow versions. The impact is limited to service disruption through unexpected termination of the application (GitHub Advisory).

The vulnerability has been patched in multiple versions: TensorFlow 2.10.0, 2.9.2, 2.8.3, and 2.7.4. The fix was implemented in GitHub commit cf70b79d2662c0d3c6af74583641e345fc939467, which adds proper validation to ensure that the shape tensor is 1D. No workarounds were available for this vulnerability, making upgrading to a patched version the only solution (GitHub Advisory).