PT-2025-3118 · Keras+1 · Keras+1

Published 2025-01-08 · Updated 2025-01-10 · CVE-2024-55459

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Keras version 3.7.0

Description The issue allows attackers to write arbitrary files to the user's machine by downloading a crafted tar file through the get file function. This enables attackers to potentially compromise the user's system by writing malicious files.

Recommendations For Keras version 3.7.0, consider disabling the get file function until a patch is available to prevent arbitrary file writes. Restrict access to the get file function to minimize the risk of exploitation. Avoid using the get file function to download untrusted tar files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

CWE-494

Related Identifiers

AZL-55313

CVE-2024-55459

GHSA-CJGQ-5QMW-RCJ6

PYSEC-2025-121

Affected Products

Debian

Keras

References · 18

• 🔥 https://river-bicycle-f1e.notion.site/Arbitrary-File-Write-Vulnerability-in-get_file-function-11888e31952580179224e50892976d32 · Exploit
• 🔥 https://github.com/mselbrede/CVE-2024-51442 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2024-55459 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-55459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55459 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-55459 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-55459 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-55459 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cjgq-5qmw-rcj6 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-55459 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-121 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-55313 · Vendor Advisory
• https://github.com/keras-team/keras · Note
• https://github.com/keras-team/keras/blob/8f5592bcb61ff48c96560c8923e482db1076b54a/keras/src/utils/file_utils.py#L115 · Note
• https://keras.io · Note