CVE-2020-14343

Advisory

Tf-Models-Official version 2.5.0 includes a security patch for the function 'read_yaml_to_params_dict' in 'official/modeling/hyperparams/params_dict.py'. It used unsafe yaml.load(), allowing instantiation of arbitrary objects.
https://github.com/tensorflow/models/commit/f6e9eda85f7e764e54199169ed829b94bcd07871#diff-8deb13e0080ce9697c0238e886a9de510faad3144427a5e794714b353d5ad8dc

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Tf-Models-Official version 2.5.0 includes a security patch for the function 'read_yaml_to_params_dict' in 'official/modeling/hyperparams/params_dict.py'. Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load(). See also: https://github.com/tensorflow/models/commit/f6e9eda85f7e764e54199169ed829b94bcd07871#diff-8deb13e0080ce9697c0238e886a9de510faad3144427a5e794714b353d5ad8dc

Resources

• https://pypi.org/project/tf-models-official
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14343