Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrading Tensorflow to 1.15.4 in tf.txt #1341

Closed
Rajmehta123 opened this issue Nov 13, 2020 · 12 comments
Closed

Upgrading Tensorflow to 1.15.4 in tf.txt #1341

Rajmehta123 opened this issue Nov 13, 2020 · 12 comments

Comments

@Rajmehta123
Copy link

Rajmehta123 commented Nov 13, 2020

What problem are we trying to solve?:

There are many security risks around TensorFlow version 1.15.2. These issues have been fixed in version 1.15.4 and newer versions. Newer versions have also been optimized better than 1.15.2.

How can we solve it?:

Upgrading the TensorFlow to 1.15.4 in the deeppavlov>>requirements>>tf.txt from tensorflow==1.15.2 to tensorflow==1.15.4.

Are there other issues that block this solution?:

Missing out on the optimization and security enhancements.

Any important aspect to consider?:

Making sure that upgrading the TensorFlow to 1.15.4 causes no issue in syntaxes and yields the same results as 1.15.2.
@danielkornev
Copy link
Member

Idea is cool and good. We have some plans to make TF upgrades down the road for the next year, but not as fast as you might think. However, if you think you could try to work on some of this stuff, well, we'd be thrilled to help!

@Rajmehta123
Copy link
Author

Rajmehta123 commented Nov 16, 2020

Yes. I can surely contribute. I will upgrade it to TensorFlow 1.15.4 and check for any compatibility issue. Most likely, there won't be an issue with .4 version. I will update soon.

@danielkornev
Copy link
Member

danielkornev commented Nov 16, 2020 via email

@moryshka
Copy link
Contributor

@Rajmehta123 Hey )
Was wondering you've had any luck with trying to do this updating?

@Rajmehta123
Copy link
Author

@moryshka Hey. Yes, I have tested on a few use cases and they don't create any problems. Looking at what TF has changed in 1.15.4, there is nothing with syntax or functionality. The release is for the fixes for bugs.

Fixes an undefined behavior causing a segfault in tf.raw_ops.Switch (CVE-2020-15190)
Fixes three vulnerabilities in conversion to DLPack format (CVE-2020-15191, CVE-2020-15192, CVE-2020-15193)
Fixes two vulnerabilities in SparseFillEmptyRowsGrad (CVE-2020-15194, CVE-2020-15195)
Fixes an integer truncation vulnerability in code using the work sharder API (CVE-2020-15202)
Fixes a format string vulnerability in tf.strings.as_string (CVE-2020-15203)
Fixes segfault raised by calling session-only ops in eager mode (CVE-2020-15204)
Fixes data leak and potential ASLR violation from tf.raw_ops.StringNGrams (CVE-2020-15205)
Fixes segfaults caused by incomplete SavedModel validation (CVE-2020-15206)
Fixes a data corruption due to a bug in negative indexing support in TFLite (CVE-2020-15207)
Fixes a data corruption due to dimension mismatch in TFLite (CVE-2020-15208)
Fixes several vulnerabilities in TFLite saved model format (CVE-2020-15209, CVE-2020-15210, CVE-2020-15211)
Updates sqlite3 to 3.33.00 to handle CVE-2020-9327, CVE-2020-11655, CVE-2020-11656, CVE-2020-13434, CVE-2020-13435, CVE-2020-13630, CVE-2020-13631, CVE-2020-13871, and CVE-2020-15358.
Fixes #41630 by including max_seq_length in CuDNN descriptor cache key
Pins numpy to 1.18.5 to prevent ABI breakage when compiling code that uses both NumPy and TensorFlow headers.

@Rajmehta123 Rajmehta123 reopened this Dec 11, 2020
@danielkornev
Copy link
Member

danielkornev commented Dec 11, 2020 via email

@danielkornev
Copy link
Member

@IgnatovFedor

@Rajmehta123
Copy link
Author

@danielkornev Yes we can migrate to 1.15.4 to include security updates

@Rajmehta123
Copy link
Author

@danielkornev @IgnatovFedor Any update on the upgrade?

@danielkornev
Copy link
Member

We shipped it in 0.14.

@Rajmehta123
Copy link
Author

Yes just realized. Thanks

@danielkornev
Copy link
Member

danielkornev commented Jan 22, 2021 via email

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants