CVE-2021-35958: Path Traversal
DISPUTED TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.getfile is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.getfile is not intended for untrusted archives.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-35958?
CVE-2021-35958 is classified as a moderate severity vulnerability due to the potential for arbitrary file overwrites.
How do I fix CVE-2021-35958?
To mitigate CVE-2021-35958, avoid using the tf.keras.utils.get_file method with extract=True on untrusted archives.
Which versions of TensorFlow are affected by CVE-2021-35958?
CVE-2021-35958 affects versions of TensorFlow from 0.1.0 up to and including 2.5.0.
Can CVE-2021-35958 lead to remote code execution?
CVE-2021-35958 itself does not directly lead to remote code execution, but can allow an attacker to overwrite arbitrary files on the system.
Is there a recommended workaround for CVE-2021-35958?
The recommended workaround for CVE-2021-35958 is to validate and sanitize all inputs to tf.keras.utils.get_file before extraction.