Patchwire CVEs, their patch status, and feeds to follow them

CVE-2024-3660

Fixed upstream EPSS 2%CVSS 9.8

A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.

Published 2024-04-16 · CVE record · OSV

Products: tensorflow keras, tensorflow

Fixed upstream

EcosystemPackageFixed in
PyPIkeras2.13.1rc0

Distro releases

ReleasePackageFixed in
Debian 11kerasno fix
Ubuntu 18.04 LTSkerasno fix
Ubuntu 20.04 LTSkerasno fix