CVE-2022-36001: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, was found to contain a vulnerability in the DrawBoundingBoxes function (CVE-2022-36001). When DrawBoundingBoxes receives an input 'boxes' that is not of dtype 'float', it triggers a CHECK fail that can lead to a denial of service attack. The vulnerability was discovered in September 2022 and affects TensorFlow versions prior to 2.10.0 (GitHub Advisory).

The vulnerability occurs in the DrawBoundingBoxes function when processing input boxes with incorrect data types. The issue stems from improper input validation where the function fails to handle non-float dtype inputs correctly. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH by NVD and 5.9 MEDIUM by GitHub, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The primary impact of this vulnerability is the potential for denial of service attacks. When exploited, the CHECK fail in the DrawBoundingBoxes function can cause the application to crash, disrupting the service availability (GitHub Advisory).

The vulnerability has been patched in TensorFlow version 2.10.0. The fix has also been backported to versions 2.9.1, 2.8.1, and 2.7.2. Users are advised to upgrade to these patched versions. The fix was implemented in GitHub commit da0d65cdc1270038e72157ba35bf74b85d9bda11. There are no known workarounds for this issue (GitHub Advisory).