CVE-2021-35958

CRITICAL9.1EPSS 1.1%

Published: 3/6/2024Modified: 4/3/2025

Description

TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.get_file is not intended for untrusted archives

Affected packages (1)

Bitnami/tensorflowfrom 0, < 2.5.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References (6)

WEBhttps://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall
WEBhttps://github.com/tensorflow/tensorflow/blob/b8cad4c631096a34461ff8a07840d5f4d123ce32/tensorflow/python/keras/README.md
WEBhttps://github.com/tensorflow/tensorflow/blob/b8cad4c631096a34461ff8a07840d5f4d123ce32/tensorflow/python/keras/utils/data_utils.py#L137
WEBhttps://keras.io/api/
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2021-35958
WEBhttps://vuln.ryotak.me/advisories/52