PT-2021-21079 · Google · Tensorflow

Ryotak · Published 2021-06-30 · Updated 2024-08-04 · CVE-2021-35958

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.1

Description: The issue allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get file is used with extract=True. It's noted that the vendor's position is that tf.keras.utils.get file is not intended for untrusted archives.

Recommendations: For versions prior to 2.5.1, as a temporary workaround, consider avoiding the use of tf.keras.utils.get file with extract=True for untrusted archives until a patch is available. Restrict the use of tf.keras.utils.get file to trusted archives to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-TENSORFLOW-2021-35958

CVE-2021-35958

Affected Products

Tensorflow

References · 11

• https://osv.dev/vulnerability/CVE-2021-35958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35958 · Security Note
• https://osv.dev/vulnerability/BIT-tensorflow-2021-35958 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/b8cad4c631096a34461ff8a07840d5f4d123ce32/tensorflow/python/keras/utils/data_utils.py#L137 · Note
• https://github.com/tensorflow/tensorflow/blob/b8cad4c631096a34461ff8a07840d5f4d123ce32/tensorflow/python/keras/README.md · Note
• https://t.me/cvenotify/16874 · Telegram Post
• https://keras.io/api · Note
• https://t.me/cvenotify/17135 · Telegram Post
• https://vuln.ryotak.me/advisories/52 · Note
• https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall · Note
• https://t.me/cvenotify/88874 · Telegram Post