A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to     execute arbitrary code with the same permissions as the application using a model that allow arbitrary     code irrespective of the application. (CVE-2024-3660)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) allows attackers to
    execute arbitrary code with the same permissions as the application using a model that allow arbitrary
    code irrespective of the application. (CVE-2024-3660)

The version of Keras installed on the remote host is prior to 2.13. It is, therefore, affected by an arbitrary code injection vulnerability in TensorFlow's Keras framework (<2.13) which allows attackers to execute arbitrary code with the same permissions as the application using a model that allow arbitrary code irrespective of the application.

    Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
260147	Linux Distros Unpatched Vulnerability : CVE-2024-3660	Nessus	Misc.	Local	critical
421413	SCA: security update for keras (GHSA-x4wf-678h-2pmq)	Tenable Cloud Security	SCA Checks	Local	critical
421413	SCA: security update for keras (GHSA-x4wf-678h-2pmq)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
205011	Keras < 2.13 Arbitrary Code Injection	Nessus	Artificial Intelligence	Local	critical

Detections

Analytics

CVE-2024-3660

critical

Tenable Plugins

critical

critical

critical

critical