CVE-2021-35958

Name
CVE-2021-35958
Description
TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.get_file is not intended for untrusted archives
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://keras.io/api/
MISC https://github.com/tensorflow/tensorflow/blob/b8cad4c631096a34461ff8a07840d5f4d123ce32/tensorflow/python/keras/utils/data_utils.py#L137
MISC https://github.com/tensorflow/tensorflow/blob/b8cad4c631096a34461ff8a07840d5f4d123ce32/tensorflow/python/keras/README.md
MISC https://vuln.ryotak.me/advisories/52
MISC https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:tensorflow:tensorflow:*:*:*:*:*:*:*:* tensorflow >= None <= 2.5.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status