CVE-2024-55459: keras Path Traversal vulnerability
An issue in keras 3.7.0 allows attackers to write arbitrary files to the user’s machine via downloading a crafted tar file through the get_file function.
References
- github.com/advisories/GHSA-cjgq-5qmw-rcj6
- github.com/keras-team/keras
- github.com/keras-team/keras/blob/8f5592bcb61ff48c96560c8923e482db1076b54a/keras/src/utils/file_utils.py
- keras.io/
- nvd.nist.gov/vuln/detail/CVE-2024-55459
- river-bicycle-f1e.notion.site/Arbitrary-File-Write-Vulnerability-in-get_file-function-11888e31952580179224e50892976d32
Code Behaviors & Features
Detect and mitigate CVE-2024-55459 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →