Lookup for vulnerable packages by Package URL.
| Purl | pkg:pypi/keras@2.13.1rc0 |
|---|
| Type | pypi |
|---|
| Namespace | |
|---|
| Name | keras |
|---|
| Version | 2.13.1rc0 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | false |
|---|
| Next_non_vulnerable_version | 3.13.2 |
|---|
| Latest_non_vulnerable_version | 3.13.2 |
|---|
| Affected_by_vulnerabilities |
|
|---|
| Fixing_vulnerabilities |
| 0 |
| url |
VCID-3sjs-86sn-fbe2 |
| vulnerability_id |
VCID-3sjs-86sn-fbe2 |
| summary |
Keras code injection vulnerability
A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-3660, GHSA-x4wf-678h-2pmq
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3sjs-86sn-fbe2 |
|
|
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:pypi/keras@2.13.1rc0 |
|---|