PyPi: Tensorflow-Federated

CVE-2022-29210

Transitive

Safety vulnerability ID: 49291

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at May 21, 2022 Updated at May 09, 2024
Scan your Python projects for vulnerabilities →

Advisory

Tensorflow-federated 0.25.0 updates its dependency 'TensorFlow' to v2.9.0 to include security fixes.

Affected package

tensorflow-federated

Latest version: 0.78.0

TensorFlow Federated is an open-source federated learning framework.

Affected versions

Fixed versions

Vulnerability changelog

Major Features and Improvements

* Adds error message logging to TFF C++ execution context.
* Adds test coverage for C++ runtime with aggregators.
* Redefines 'workers going down with fixed clients per round' test.
* Add complete examples of using `DataBackend` with TFF comps.
* Updated the MapReduceForm documentation to include the two additional secure
sum intrinsics.
* tff.learning
* Relax the type check on LearningProcess from strictly SequenceType to
also allow structures of SequenceType.

Breaking Changes

* Remove usage of `tff.test.TestCase`, `tff.test.main()`, and delete
`test_case` module.
* Update test utility docstrings to use consistent vocabulary.
* Update to TensorFlow 2.9.0
* Rename up `compiler/test_utils` to `compiler/building_block_test_utils`.
* Remove some unnecessary usage of `pytype: skip-file`.
* Specify the `None` return type of `ReleaseManager.release`.
* Remove usage of deprecated numpy types.
* Replace depreciated `random_integers` with `randint`.

Bug Fixes

* Fix numpy warning.

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application

Severity Details

CVSS Base Score

MEDIUM 5.5

CVSS v3 Details

MEDIUM 5.5
Attack Vector (AV)
LOCAL
Attack Complexity (AC)
LOW
Privileges Required (PR)
LOW
User Interaction (UI)
NONE
Scope (S)
UNCHANGED
Confidentiality Impact (C)
NONE
Integrity Impact (I)
NONE
Availability Availability (A)
HIGH

CVSS v2 Details

LOW 2.1
Access Vector (AV)
LOCAL
Access Complexity (AC)
LOW
Authentication (Au)
NONE
Confidentiality Impact (C)
NONE
Integrity Impact (I)
NONE
Availability Impact (A)
PARTIAL