fixed Arbitrary Code Execution

tensorflow/python/keras/saving/model_config.py

@@ -95,11 +95,12 @@ def model_from_yaml(yaml_string, custom_objects=None):
     raise ImportError('Requires yaml module installed (`pip install pyyaml`).')
   # The method unsafe_load only exists in PyYAML 5.x+, so which branch of the
   # try block is covered by tests depends on the installed version of PyYAML.
-  try:
+  #try:
     # PyYAML 5.x+
-    config = yaml.unsafe_load(yaml_string)
-  except AttributeError:
-    config = yaml.load(yaml_string)
+  #  config = yaml.safe_load(yaml_string)
+  #except AttributeError:
+  #  config = yaml.safe_load(yaml_string)
+  config = yaml.safe_load(yaml_string)
   from tensorflow.python.keras.layers import deserialize  # pylint: disable=g-import-not-at-top
   return deserialize(config, custom_objects=custom_objects)
 

tensorflow/tools/ci_build/Dockerfile.micro

@@ -1,7 +1,7 @@
 # Use a prebuilt Python image instead of base Ubuntu to speed up the build process,
 # since it has all the build dependencies we need for Micro and downloads much faster
 # than the install process.
-FROM python:3.9.0-buster
+FROM python:3.9-buster
 
 LABEL maintainer="Pete Warden <[email protected]>"