One Article Review
| Source |  CVE Liste |
|---|---|
| Identifiant | 4728933 |
| Date de publication | 2022-05-21 00:15:11 (vue: 2022-05-21 06:08:39) |
| Titre | CVE-2022-29216 |
| Texte | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, TensorFlow's `saved_model_cli` tool is vulnerable to a code injection. This can be used to open a reverse shell. This code path was maintained for compatibility reasons as the maintainers had several test cases where numpy expressions were used as arguments. However, given that the tool is always run manually, the impact of this is still not severe. The maintainers have now removed the `safe=False` argument, so all parsing is done without calling `eval`. The patch is available in versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4. |
| Envoyé | Oui |
| Condensat | 2022 29216 `eval` `safe=false` `saved all always argument arguments available calling can cases cli` code compatibility cve done expressions given had have however impact injection learning machine maintained maintainers manually model not now numpy open parsing patch path platform prior reasons removed reverse run several severe shell source tensorflow test tool used versions vulnerable where without |
| Tags | Tool |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.