CVE-2024-55459: Path Traversal
Published Jan 8, 2025
·Updated
An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the getfile function.
Affected Software
2 affected components
pip/keras<=3.7.0
Keras keras=3.7.0
Event History
Jan 8, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
Affected Software
Advisory Published
via GitHub·06:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-55459?
CVE-2024-55459 has been classified as a medium severity vulnerability due to the potential for arbitrary file writing.
2
How do I fix CVE-2024-55459?
To mitigate CVE-2024-55459, users should upgrade to a version of Keras higher than 3.7.0 that addresses this vulnerability.
3
How does CVE-2024-55459 affect users?
CVE-2024-55459 allows attackers to write arbitrary files to a user's machine, posing a security risk when using the affected Keras version.
4
Which versions of Keras are affected by CVE-2024-55459?
CVE-2024-55459 affects Keras version 3.7.0 and earlier versions.
5
What is the exploit method for CVE-2024-55459?
CVE-2024-55459 is exploited through the get_file function by downloading a specially crafted tar file.