CVE-2021-37678

Advisory

Keras 2.6.0rc3 fixes a security issue for loading keras models via yaml, which could allow arbitrary code execution. See CVE-2021-37678.
https://github.com/keras-team/keras/commit/32febb6cdebe166fc70ad72f2da37607c13bb11a

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Keras Release 2.6.0 RC3 fix a security issue for loading keras models via yaml, which could allow arbitrary code execution.

Resources

• https://pypi.org/project/keras
• https://pyup.io/changelogs/keras/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1747
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37678
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-r6jx-9g48-2r5r
• https://github.com/tensorflow/tensorflow/commit/23d6383eb6c14084a8fc3bdf164043b974818012