CVE-2023-25672: 
Python vulnerability analysis and mitigation

CVE-2023-25672 affects TensorFlow, an open source platform for machine learning. The vulnerability was discovered in the function tf.raw_ops.LookupTableImportV2 which cannot handle scalar values in the values parameter, resulting in a Null Pointer Exception (NPE). The issue was disclosed on March 24, 2023, and has been patched in TensorFlow versions 2.12.0 and 2.11.1 (GitHub Advisory).

The vulnerability is classified as a Null Pointer Exception (NPE) with a CVSS v3.1 Base Score of 7.5 (HIGH), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue occurs specifically when scalar values are passed to the values parameter in the tf.raw_ops.LookupTableImportV2 function, causing a shape inference error that results in a null pointer exception (NVD).

The vulnerability can lead to application crashes due to null pointer exceptions when attempting to use scalar values in the affected function. This primarily affects availability of systems using the vulnerable versions of TensorFlow (GitHub Advisory).

The vulnerability has been fixed in TensorFlow versions 2.12.0 and 2.11.1. Users should upgrade to these or later versions to address the issue. The fix was implemented in GitHub commit 980b22536abcbbe1b4a5642fc940af33d8c19b69 (GitHub Commit).