v3.12.4
Keras 3.12.4
Security 4
- Restrict unpickling when loading IMDB and Reuters datasets to only permit numpy array reconstruction, preventing arbitrary code execution via crafted .npz files
- Verify all intermediary H5 groups when navigating H5 files to prevent potential path traversal
- Reject decompression-bomb members on the .keras asset extraction path by adding per-member decompression-ratio checks before extracting archives to disk
- Restrict unpickling when loading CIFAR datasets to block arbitrary code execution via pickle gadgets
Keras 3.12.4
Keras 3.12.4 is a security patch release that hardens dataset loading and model file handling against insecure deserialization and decompression-bomb attacks.
Security Fixes
- Restrict unpickling when loading IMDB and Reuters datasets — Replaces
np.load(allow_pickle=True)with a restricted unpickler that only permits numpy array reconstruction, preventing arbitrary code execution via crafted.npzfiles (CWE-502). (#23047) by @LinZiyuu - Verify all intermediary H5 groups when navigating H5 files — Manually resolves nested H5 group paths to verify group types at each step, preventing potential path traversal. (#23168) by @hertschuh
- Reject decompression-bomb members on the
.kerasasset extraction path — Adds per-member decompression-ratio checks before extracting.kerasarchives to disk, preventing disk-exhaustion attacks via crafted archives. (#23101) by @LinZiyuu - Restrict unpickling when loading CIFAR datasets — Replaces bare
cPickle.loadin CIFAR-10/100 batch loading with the numpy-onlyRestrictedUnpickler, blocking arbitrary code execution via pickle gadgets. (#23252) by @SABITHSAHEB
Contributors
Thank you to all the contributors who made this release possible! 🎉
- @LinZiyuu — Security hardening for IMDB, Reuters, and
.kerasasset extraction (#23047, #23101) - @hertschuh — H5 group verification (#23168)
- @SABITHSAHEB — CIFAR dataset pickle restriction (#23252)
Full Changelog: https://github.com/keras-team/keras/compare/v3.12.3...v3.12.4