dependabot[bot] opened a new pull request, #17745: URL: https://github.com/apache/beam/pull/17745
Bumps [tensorflow](https://github.com/tensorflow/tensorflow) from 2.8.0 to 2.8.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tensorflow/tensorflow/releases";>tensorflow's releases</a>.</em></p> <blockquote> <h2>TensorFlow 2.8.1</h2> <h1>Release 2.8.1</h1> <p>This releases introduces several vulnerability fixes:</p> <ul> <li>Fixes a code injection in <code>saved_model_cli</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29216";>CVE-2022-29216</a>)</li> <li>Fixes a missing validation which causes <code>TensorSummaryV2</code> to crash (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29193";>CVE-2022-29193</a>)</li> <li>Fixes a missing validation which crashes <code>QuantizeAndDequantizeV4Grad</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29192";>CVE-2022-29192</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>DeleteSessionTensor</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29194";>CVE-2022-29194</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>GetSessionTensor</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29191";>CVE-2022-29191</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>StagePeek</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29195";>CVE-2022-29195</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>UnsortedSegmentJoin</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29197";>CVE-2022-29197</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>LoadAndRemapMatrix</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29199";>CVE-2022-29199</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>SparseTensorToCSRSparseMatrix</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29198";>CVE-2022-29198</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>LSTMBlockCell</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29200";>CVE-2022-29200</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>Conv3DBackpropFilterV2</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29196";>CVE-2022-29196</a>)</li> <li>Fixes a <code>CHECK</code> failure in depthwise ops via overflows (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41197";>CVE-2021-41197</a>)</li> <li>Fixes issues arising from undefined behavior stemming from users supplying invalid resource handles (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29207";>CVE-2022-29207</a>)</li> <li>Fixes a segfault due to missing support for quantized types (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29205";>CVE-2022-29205</a>)</li> <li>Fixes a missing validation which results in undefined behavior in <code>SparseTensorDenseAdd</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29206";>CVE-2022-29206</a>)</li> <li>Fixes a missing validation which results in undefined behavior in <code>QuantizedConv2D</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29201";>CVE-2022-29201</a>)</li> <li>Fixes an integer overflow in <code>SpaceToBatchND</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29203";>CVE-2022-29203</a>)</li> <li>Fixes a segfault and OOB write due to incomplete validation in <code>EditDistance</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29208";>CVE-2022-29208</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>Conv3DBackpropFilterV2</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29204";>CVE-2022-29204</a>)</li> <li>Fixes a denial of service in <code>tf.ragged.constant</code> due to lack of validation (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29202";>CVE-2022-29202</a>)</li> <li>Fixes a segfault when <code>tf.histogram_fixed_width</code> is called with NaN values (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29211";>CVE-2022-29211</a>)</li> <li>Fixes a core dump when loading TFLite models with quantization (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29212";>CVE-2022-29212</a>)</li> <li>Fixes crashes stemming from incomplete validation in signal ops (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29213";>CVE-2022-29213</a>)</li> <li>Fixes a type confusion leading to <code>CHECK</code>-failure based denial of service (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29209";>CVE-2022-29209</a>)</li> <li>Fixes a heap buffer overflow due to incorrect hash function (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29210";>CVE-2022-29210</a>)</li> <li>Updates <code>curl</code> to <code>7.83.1</code> to handle (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-22576";>CVE-2022-22576</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27774";>CVE-2022-27774</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27775";>CVE-2022-27775</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27776";>CVE-2022-27776</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27778";>CVE-2022-27778</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27779";>CVE-2022-27779</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27780";>CVE-2022-27780</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27781";>CVE-2022-27781</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27782";>CVE-2022-27782</a> and (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-30115";>CVE-2022-30115</a></li> <li>Updates <code>zlib</code> to <code>1.2.12</code> after <code>1.2.11</code> was pulled due to <a href="https://www.openwall.com/lists/oss-security/2022/03/28/1";>security issue</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tensorflow/tensorflow/blob/master/RELEASE.md";>tensorflow's changelog</a>.</em></p> <blockquote> <h1>Release 2.8.1</h1> <p>This releases introduces several vulnerability fixes:</p> <ul> <li>Fixes a code injection in <code>saved_model_cli</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29216";>CVE-2022-29216</a>)</li> <li>Fixes a missing validation which causes <code>TensorSummaryV2</code> to crash (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29193";>CVE-2022-29193</a>)</li> <li>Fixes a missing validation which crashes <code>QuantizeAndDequantizeV4Grad</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29192";>CVE-2022-29192</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>DeleteSessionTensor</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29194";>CVE-2022-29194</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>GetSessionTensor</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29191";>CVE-2022-29191</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>StagePeek</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29195";>CVE-2022-29195</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>UnsortedSegmentJoin</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29197";>CVE-2022-29197</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>LoadAndRemapMatrix</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29199";>CVE-2022-29199</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>SparseTensorToCSRSparseMatrix</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29198";>CVE-2022-29198</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>LSTMBlockCell</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29200";>CVE-2022-29200</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>Conv3DBackpropFilterV2</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29196";>CVE-2022-29196</a>)</li> <li>Fixes a <code>CHECK</code> failure in depthwise ops via overflows (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41197";>CVE-2021-41197</a>)</li> <li>Fixes issues arising from undefined behavior stemming from users supplying invalid resource handles (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29207";>CVE-2022-29207</a>)</li> <li>Fixes a segfault due to missing support for quantized types (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29205";>CVE-2022-29205</a>)</li> <li>Fixes a missing validation which results in undefined behavior in <code>SparseTensorDenseAdd</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29206";>CVE-2022-29206</a>)</li> <li>Fixes a missing validation which results in undefined behavior in <code>QuantizedConv2D</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29201";>CVE-2022-29201</a>)</li> <li>Fixes an integer overflow in <code>SpaceToBatchND</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29203";>CVE-2022-29203</a>)</li> <li>Fixes a segfault and OOB write due to incomplete validation in <code>EditDistance</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29208";>CVE-2022-29208</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>Conv3DBackpropFilterV2</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29204";>CVE-2022-29204</a>)</li> <li>Fixes a denial of service in <code>tf.ragged.constant</code> due to lack of validation (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29202";>CVE-2022-29202</a>)</li> <li>Fixes a segfault when <code>tf.histogram_fixed_width</code> is called with NaN values (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29211";>CVE-2022-29211</a>)</li> <li>Fixes a core dump when loading TFLite models with quantization (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29212";>CVE-2022-29212</a>)</li> <li>Fixes crashes stemming from incomplete validation in signal ops (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29213";>CVE-2022-29213</a>)</li> <li>Fixes a type confusion leading to <code>CHECK</code>-failure based denial of service (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29209";>CVE-2022-29209</a>)</li> <li>Fixes a heap buffer overflow due to incorrect hash function (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29210";>CVE-2022-29210</a>)</li> <li>Updates <code>curl</code> to <code>7.83.1</code> to handle (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-22576";>CVE-2022-22576</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27774";>CVE-2022-27774</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27775";>CVE-2022-27775</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27776";>CVE-2022-27776</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27778";>CVE-2022-27778</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27779";>CVE-2022-27779</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27780";>CVE-2022-27780</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27781";>CVE-2022-27781</a>, (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-27782";>CVE-2022-27782</a> and (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=VE-2022-30115";>CVE-2022-30115</a></li> <li>Updates <code>zlib</code> to <code>1.2.12</code> after <code>1.2.11</code> was pulled due to <a href="https://www.openwall.com/lists/oss-security/2022/03/28/1";>security issue</a></li> </ul> <h1>Release 2.7.2</h1> <p>This releases introduces several vulnerability fixes:</p> <ul> <li>Fixes a code injection in <code>saved_model_cli</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29216";>CVE-2022-29216</a>)</li> <li>Fixes a missing validation which causes <code>TensorSummaryV2</code> to crash (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29193";>CVE-2022-29193</a>)</li> <li>Fixes a missing validation which crashes <code>QuantizeAndDequantizeV4Grad</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29192";>CVE-2022-29192</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>DeleteSessionTensor</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29194";>CVE-2022-29194</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>GetSessionTensor</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29191";>CVE-2022-29191</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>StagePeek</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29195";>CVE-2022-29195</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>UnsortedSegmentJoin</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29197";>CVE-2022-29197</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>LoadAndRemapMatrix</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29199";>CVE-2022-29199</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>SparseTensorToCSRSparseMatrix</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29198";>CVE-2022-29198</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>LSTMBlockCell</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29200";>CVE-2022-29200</a>)</li> <li>Fixes a missing validation which causes denial of service via <code>Conv3DBackpropFilterV2</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29196";>CVE-2022-29196</a>)</li> <li>Fixes a <code>CHECK</code> failure in depthwise ops via overflows (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41197";>CVE-2021-41197</a>)</li> <li>Fixes issues arising from undefined behavior stemming from users supplying invalid resource handles (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29207";>CVE-2022-29207</a>)</li> <li>Fixes a segfault due to missing support for quantized types (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29205";>CVE-2022-29205</a>)</li> <li>Fixes a missing validation which results in undefined behavior in <code>SparseTensorDenseAdd</code> (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29206";>CVE-2022-29206</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tensorflow/tensorflow/commit/0516d4d8bced506cae97dc3cb45dbd2fe4311f26";><code>0516d4d</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/56035";>#56035</a> from tensorflow-jenkins/relnotes-2.8.1-4205</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/25faa9f51698b743af7f66304efa2d412a15427a";><code>25faa9f</code></a> Update RELEASE.md</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/0d75d6ad32402c939ca29b73de47ea2b2b3a03d2";><code>0d75d6a</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/56074";>#56074</a> from tensorflow/fix-r2.8-build</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/b82dff5267ac2b6bac124d24929b2b4a891338a8";><code>b82dff5</code></a> Install dep as user</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/1e7468765d5aac6208b3df06dea8747aea2dd7d5";><code>1e74687</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/56071";>#56071</a> from tensorflow/fix-r2.8-build</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/86bbc7004f0631a194ae1ea48f8f6b69811cdb84";><code>86bbc70</code></a> Another attempt at fixing <a href="https://github-redirect.dependabot.com/pypa/setuptools/issues/3293";>pypa/setuptools#3293</a></li> <li><a href="https://github.com/tensorflow/tensorflow/commit/fd5fbebf32a09030ea30f2324ed2276b104e3c9c";><code>fd5fbeb</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/56068";>#56068</a> from tensorflow/mm-cp-52488e5072f6fe44411d70c6af09e...</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/bdb80bc3de2f412cf27747f9e68d93f5a69283ce";><code>bdb80bc</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/56060";>#56060</a> from yongtang:curl-7.83.1</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/3f8784c87c7647b11683e8b7a21b355e03a570b4";><code>3f8784c</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/tensorflow/tensorflow/issues/56064";>#56064</a> from tensorflow/mihaimaruseac-patch-1</li> <li><a href="https://github.com/tensorflow/tensorflow/commit/0da453f218b4ed7c53fa2b5a0fcb5b272944fbb3";><code>0da453f</code></a> Fix pip install ordering</li> <li>Additional commits viewable in <a href="https://github.com/tensorflow/tensorflow/compare/v2.8.0...v2.8.1";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/beam/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
