Skip to content

Commit d459b0c

Browse files
[AUTO-CHERRYPICK] Patch keras for CVE-2025-1550 [High] - branch 3.0-dev (#12963)
Co-authored-by: bhagyapathak <bhagyapathak@users.noreply.github.com>
1 parent 319921e commit d459b0c

2 files changed

Lines changed: 79 additions & 1 deletion

File tree

SPECS/keras/CVE-2025-1550.patch

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
From d66480736192e94b7bdfb1d31533c44b73a1ca05 Mon Sep 17 00:00:00 2001
2+
From: Fabien Hertschuh <1091026+hertschuh@users.noreply.github.com>
3+
Date: Sun, 12 Jan 2025 14:22:24 -0800
4+
Subject: [PATCH] Add checks to deserialization.
5+
6+
In particular for functional models.
7+
---
8+
keras-3.3.3/keras/src/models/functional.py | 6 ++++++
9+
keras-3.3.3/keras/src/saving/serialization_lib.py | 28 ++++++++++++---------------
10+
2 files changed, 18 insertions(+), 16 deletions(-)
11+
12+
diff --git keras-3.3.3/keras/src/models/functional.py keras-3.3.3/keras/src/models/functional.py
13+
index e01052bc57ec..f2ff70396fbf 100644
14+
--- keras-3.3.3/keras/src/models/functional.py
15+
+++ keras-3.3.3/keras/src/models/functional.py
16+
@@ -19,6 +19,7 @@
17+
from keras.src.ops.function import make_node_key
18+
from keras.src.ops.node import KerasHistory
19+
from keras.src.ops.node import Node
20+
+from keras.src.ops.operation import Operation
21+
from keras.src.saving import serialization_lib
22+
from keras.src.utils import tracking
23+
24+
@@ -523,6 +524,11 @@ def process_layer(layer_data):
25+
layer = serialization_lib.deserialize_keras_object(
26+
layer_data, custom_objects=custom_objects
27+
)
28+
+ if not isinstance(layer, Operation):
29+
+ raise ValueError(
30+
+ "Unexpected object from deserialization, expected a layer or "
31+
+ f"operation, got a {type(layer)}"
32+
+ )
33+
created_layers[layer_name] = layer
34+
35+
# Gather layer inputs.
36+
diff --git keras-3.3.3/keras/src/saving/serialization_lib.py keras-3.3.3/keras/src/saving/serialization_lib.py
37+
index cf8eb327fb40..535478b62bb6 100644
38+
--- keras-3.3.3/keras/src/saving/serialization_lib.py
39+
+++ keras-3.3.3/keras/src/saving/serialization_lib.py
40+
@@ -783,22 +783,18 @@ def _retrieve_class_or_fn(
41+
42+
# Otherwise, attempt to retrieve the class object given the `module`
43+
# and `class_name`. Import the module, find the class.
44+
- try:
45+
- mod = importlib.import_module(module)
46+
- except ModuleNotFoundError:
47+
- raise TypeError(
48+
- f"Could not deserialize {obj_type} '{name}' because "
49+
- f"its parent module {module} cannot be imported. "
50+
- f"Full object config: {full_config}"
51+
- )
52+
- obj = vars(mod).get(name, None)
53+
-
54+
- # Special case for keras.metrics.metrics
55+
- if obj is None and registered_name is not None:
56+
- obj = vars(mod).get(registered_name, None)
57+
-
58+
- if obj is not None:
59+
- return obj
60+
+ if module == "keras.src" or module.startswith("keras.src."):
61+
+ try:
62+
+ mod = importlib.import_module(module)
63+
+ obj = vars(mod).get(name, None)
64+
+ if obj is not None:
65+
+ return obj
66+
+ except ModuleNotFoundError:
67+
+ raise TypeError(
68+
+ f"Could not deserialize {obj_type} '{name}' because "
69+
+ f"its parent module {module} cannot be imported. "
70+
+ f"Full object config: {full_config}"
71+
+ )
72+
73+
raise TypeError(
74+
f"Could not locate {obj_type} '{name}'. "

SPECS/keras/keras.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: Keras is a high-level neural networks API.
44
Name: keras
55
Version: 3.3.3
6-
Release: 1%{?dist}
6+
Release: 2%{?dist}
77
License: ASL 2.0
88
Vendor: Microsoft Corporation
99
Distribution: Azure Linux
@@ -12,6 +12,7 @@ URL: https://keras.io/
1212
Source0: https://github.com/keras-team/keras/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
1313
#Removes circular dependency between keras and tensorflow. Plus Enables Wheel installation.
1414
Patch00: 0001-Add-Keras-3.3.3.patch
15+
Patch01: CVE-2025-1550.patch
1516
BuildRequires: git
1617
BuildRequires: libstdc++-devel
1718
BuildRequires: pyproject-rpm-macros
@@ -69,6 +70,9 @@ python3 pip_build.py --install
6970

7071

7172
%changelog
73+
* Wed Mar 12 2025 Bhagyashri Pathak <bhapathak@microsoft.com> - 3.3.3-2
74+
- Patch for CVE-2025-1550
75+
7276
* Mon Jun 24 2024 Riken Maharjan <rmaharjan@microsoft.com> - 3.3.3-1
7377
- Update keras to 3.3.3 to fix GC issue.
7478

0 commit comments

Comments
 (0)