"Affected Versions" discrepancies between TFSA and GHSA
Hi, To make it clear to you the information mentioned in the TFSA

 `The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.` 

states that the fix was included in the mentioned versions only.
The fix is not part of all the affected versions, i.e anything `< 2.6` version did not come under our support window policy.  
Our patch release policy during that timeline which we followed was:
 `All TF minor releases are supported for 1 year. This means we aim to release patches for any vulnerability detected in TF for 1 year year after the “X.X.0” release date.`

@mihaimaruseac , Correct me if my understanding is wrong, the advisory which was added by you for [TFSA-2022-035](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2022-035.md) Hi! Thank you for explaining that to me! I think I better understand the versions that are listed on your security advisory now. To better explain the context behind my use case, I'm curating a list of many versions of tensorflow, and trying to figure out which vulnerabilities affect which versions.

I think now I see that the "Versions affected" in the [security readme list](https://github.com/tensorflow/tensorflow/tree/master/tensorflow/security) are referring to the "affected versions which are still supported at the time of the TFSA being released", but am I correct in understanding that the versions that example issue (and issues like it) affects are actually `< 2.8.0`, like is listed in your [GHSA entry](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rww7-2gpw-fv6j)? 

In other words, can I assume that vulnerability would be present in all the lower versions of tensorflow that aren't specifically mentioned as being patched, like the [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2022-23572) asserts? So something like 2.2.0 would be affected even though it wouldn't be considered affected in the `>= 2.6.0, < 2.8.0` versions from the security readme list? 

 Hello,

Both GHSA and TFSA are correct at the time of their release and should be equivalent. However, they each summarize the affected range differently, and that results in issues like the one you identified when new releases are created.

For your specific question in the above comment, in general you __cannot__ make that assumption _if you want to have no false positives_. We only used to check the versions that are still in the support window (that is, that were released in the past year), but now even that is no longer done. Newer vulns are only patched at head, on the next stable release and only very critical ones will see an update on a previous version.

To see the actual affected range, you'd need to look at the history of the code around the fix, but TF has too many commits daily so this does not scale, especially if you want to do it automatically.

As a rule of thumb, I'd say using `< x.y.0` is the best, although it comes with all of the false positives mentioned above. If these false positives are something that are not an issue, then please assume `< x.y.0`

PS: For the cases where the advisory specified a range (such as `>= 2.6.0, < 2.8.0`), this means that we have validated that the code has been inserted after the branch for 2.5.0 has been cut. But these assertions are going to be rarer, given security team changes which resulted in changes in the workflows around handling security vulnerabilities
 Got it, thank you so much for the clear information, it helps figure out how best I can do this automatically, and what limitations I'll put in place! I'm okay with closing this, unless there's anything else you'd like to use the issue to work on. Thank you very much! Are you satisfied with the resolution of your issue?
<a href="https://docs.google.com/forms/d/e/1FAIpQLSfaP12TRhd9xSxjXZjcZFNXPGk4kc1-qMdv3gc6bEP90vY1ew/viewform?entry.85265664=Yes&entry.2137816233=https://github.com/tensorflow/tensorflow/issues/60344">Yes</a>
<a href="https://docs.google.com/forms/d/e/1FAIpQLSfaP12TRhd9xSxjXZjcZFNXPGk4kc1-qMdv3gc6bEP90vY1ew/viewform?entry.85265664=No&entry.2137816233=https://github.com/tensorflow/tensorflow/issues/60344">No</a>

### System information

-   **Have I written custom code (as opposed to using a stock example script
    provided in TensorFlow)**: N/A
-   **OS Platform and Distribution (e.g., Linux Ubuntu 16.04)**: N/A
-   **Mobile device (e.g. iPhone 8, Pixel 2, Samsung Galaxy) if the issue
    happens on a mobile device**: N/A
-   **TensorFlow installed from (source or binary)**: N/A
-   **TensorFlow version (use command below)**: N/A
-   **Python version**: N/A
-   **Bazel version (if compiling from source)**: N/A
-   **GCC/Compiler version (if compiling from source)**: N/A
-   **CUDA/cuDNN version**: N/A
-   **GPU model and memory**: N/A
-   **Exact command to reproduce**: N/A


### Describe the problem
There are "affected versions" discrepancies between [GHSA](https://github.com/tensorflow/tensorflow/security) and [TFSA](https://github.com/tensorflow/tensorflow/tree/master/tensorflow/security) security advisories. I don't really expect this to be resolved, as the affected versions differ on almost every advisory, but perhaps it could be made clear which one of these advisories users should view as the source of truth? The security readme mentions that the TFSA list might be sunset, and only GHSA will be used, but is that definitely the case? Before that happens, which repository for security advisories should be viewed as the truth, since they are both still getting published to? Thank you!

### Source code / logs
An example of this is the [GHSA entry](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rww7-2gpw-fv6j) for CVE-2022-23572, which lists the affected versions as `< 2.8.0`, while the [TFSA Entry](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2022-035.md) lists the affected version as `>= 2.6.0, < 2.8.0` in the [security readme](https://github.com/tensorflow/tensorflow/tree/master/tensorflow/security). 
