UBUNTU-CVE-2025-1550

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2025-1550

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-1550.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-1550

Upstream

CVE-2025-1550

Published

2025-03-11T09:15:00Z

Modified

2025-10-24T05:16:29Z

Severity

7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, to be loaded and executed during model loading.

References

Affected packages

Ubuntu:18.04:LTS / keras

Package

Name: keras
Purl: pkg:deb/ubuntu/keras@2.1.1-1?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.7-2

2.*

2.1.1-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "python3-keras",
            "binary_version": "2.1.1-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-1550.json"

Ubuntu:20.04:LTS / keras