Skip to content

Commit 0c55358

Browse files
jinyan-li1jinyan-li1
authored
Patch tensoflow 2.19 inference and training images (#5304)
* Patch tensoflow 2.19 inference and training images
1 parent 5d0639d commit 0c55358

File tree

4 files changed

+250
-0
lines changed

4 files changed

+250
-0
lines changed

‎tensorflow/inference/docker/2.19/py3/Dockerfile.sagemaker.arm64.cpu.os_scan_allowlist.json‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
{
2+
"dpkg": [
3+
{
4+
"description": "It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.",
5+
"vulnerability_id": "CVE-2025-6297",
6+
"name": "CVE-2025-6297",
7+
"package_name": "dpkg",
8+
"package_details": {
9+
"file_path": null,
10+
"name": "dpkg",
11+
"package_manager": "OS",
12+
"version": "1.21.1ubuntu2.3",
13+
"release": null
14+
},
15+
"remediation": {
16+
"recommendation": {
17+
"text": "None Provided"
18+
}
19+
},
20+
"cvss_v3_score": 8.2,
21+
"cvss_v30_score": 0.0,
22+
"cvss_v31_score": 8.2,
23+
"cvss_v2_score": 0.0,
24+
"cvss_v3_severity": "HIGH",
25+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-6297.html",
26+
"source": "UBUNTU_CVE",
27+
"severity": "HIGH",
28+
"status": "ACTIVE",
29+
"title": "CVE-2025-6297 - dpkg, libdpkg-perl",
30+
"reason_to_ignore": "N/A"
31+
}
32+
],
33+
"libdpkg-perl": [
34+
{
35+
"description": "It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.",
36+
"vulnerability_id": "CVE-2025-6297",
37+
"name": "CVE-2025-6297",
38+
"package_name": "libdpkg-perl",
39+
"package_details": {
40+
"file_path": null,
41+
"name": "libdpkg-perl",
42+
"package_manager": "OS",
43+
"version": "1.21.1ubuntu2.3",
44+
"release": null
45+
},
46+
"remediation": {
47+
"recommendation": {
48+
"text": "None Provided"
49+
}
50+
},
51+
"cvss_v3_score": 8.2,
52+
"cvss_v30_score": 0.0,
53+
"cvss_v31_score": 8.2,
54+
"cvss_v2_score": 0.0,
55+
"cvss_v3_severity": "HIGH",
56+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-6297.html",
57+
"source": "UBUNTU_CVE",
58+
"severity": "HIGH",
59+
"status": "ACTIVE",
60+
"title": "CVE-2025-6297 - dpkg, libdpkg-perl",
61+
"reason_to_ignore": "N/A"
62+
}
63+
]
64+
}

‎tensorflow/inference/docker/2.19/py3/cu122/Dockerfile.sagemaker.gpu.os_scan_allowlist.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -475,5 +475,67 @@
475475
"title": "CVE-2022-2068 - openssl",
476476
"reason_to_ignore": "N/A"
477477
}
478+
],
479+
"dpkg": [
480+
{
481+
"description": "It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.",
482+
"vulnerability_id": "CVE-2025-6297",
483+
"name": "CVE-2025-6297",
484+
"package_name": "dpkg",
485+
"package_details": {
486+
"file_path": null,
487+
"name": "dpkg",
488+
"package_manager": "OS",
489+
"version": "1.21.1ubuntu2.3",
490+
"release": null
491+
},
492+
"remediation": {
493+
"recommendation": {
494+
"text": "None Provided"
495+
}
496+
},
497+
"cvss_v3_score": 8.2,
498+
"cvss_v30_score": 0.0,
499+
"cvss_v31_score": 8.2,
500+
"cvss_v2_score": 0.0,
501+
"cvss_v3_severity": "HIGH",
502+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-6297.html",
503+
"source": "UBUNTU_CVE",
504+
"severity": "HIGH",
505+
"status": "ACTIVE",
506+
"title": "CVE-2025-6297 - dpkg, libdpkg-perl",
507+
"reason_to_ignore": "N/A"
508+
}
509+
],
510+
"libdpkg-perl": [
511+
{
512+
"description": "It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.",
513+
"vulnerability_id": "CVE-2025-6297",
514+
"name": "CVE-2025-6297",
515+
"package_name": "libdpkg-perl",
516+
"package_details": {
517+
"file_path": null,
518+
"name": "libdpkg-perl",
519+
"package_manager": "OS",
520+
"version": "1.21.1ubuntu2.3",
521+
"release": null
522+
},
523+
"remediation": {
524+
"recommendation": {
525+
"text": "None Provided"
526+
}
527+
},
528+
"cvss_v3_score": 8.2,
529+
"cvss_v30_score": 0.0,
530+
"cvss_v31_score": 8.2,
531+
"cvss_v2_score": 0.0,
532+
"cvss_v3_severity": "HIGH",
533+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-6297.html",
534+
"source": "UBUNTU_CVE",
535+
"severity": "HIGH",
536+
"status": "ACTIVE",
537+
"title": "CVE-2025-6297 - dpkg, libdpkg-perl",
538+
"reason_to_ignore": "N/A"
539+
}
478540
]
479541
}

‎tensorflow/training/docker/2.19/py3/Dockerfile.sagemaker.cpu.os_scan_allowlist.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,5 +211,67 @@
211211
"status": "ACTIVE",
212212
"reason_to_ignore": "N/A"
213213
}
214+
],
215+
"dpkg": [
216+
{
217+
"description": "It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.",
218+
"vulnerability_id": "CVE-2025-6297",
219+
"name": "CVE-2025-6297",
220+
"package_name": "dpkg",
221+
"package_details": {
222+
"file_path": null,
223+
"name": "dpkg",
224+
"package_manager": "OS",
225+
"version": "1.21.1ubuntu2.3",
226+
"release": null
227+
},
228+
"remediation": {
229+
"recommendation": {
230+
"text": "None Provided"
231+
}
232+
},
233+
"cvss_v3_score": 8.2,
234+
"cvss_v30_score": 0.0,
235+
"cvss_v31_score": 8.2,
236+
"cvss_v2_score": 0.0,
237+
"cvss_v3_severity": "HIGH",
238+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-6297.html",
239+
"source": "UBUNTU_CVE",
240+
"severity": "HIGH",
241+
"status": "ACTIVE",
242+
"title": "CVE-2025-6297 - dpkg, libdpkg-perl",
243+
"reason_to_ignore": "N/A"
244+
}
245+
],
246+
"libdpkg-perl": [
247+
{
248+
"description": "It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.",
249+
"vulnerability_id": "CVE-2025-6297",
250+
"name": "CVE-2025-6297",
251+
"package_name": "libdpkg-perl",
252+
"package_details": {
253+
"file_path": null,
254+
"name": "libdpkg-perl",
255+
"package_manager": "OS",
256+
"version": "1.21.1ubuntu2.3",
257+
"release": null
258+
},
259+
"remediation": {
260+
"recommendation": {
261+
"text": "None Provided"
262+
}
263+
},
264+
"cvss_v3_score": 8.2,
265+
"cvss_v30_score": 0.0,
266+
"cvss_v31_score": 8.2,
267+
"cvss_v2_score": 0.0,
268+
"cvss_v3_severity": "HIGH",
269+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-6297.html",
270+
"source": "UBUNTU_CVE",
271+
"severity": "HIGH",
272+
"status": "ACTIVE",
273+
"title": "CVE-2025-6297 - dpkg, libdpkg-perl",
274+
"reason_to_ignore": "N/A"
275+
}
214276
]
215277
}

‎tensorflow/training/docker/2.19/py3/cu125/Dockerfile.sagemaker.gpu.os_scan_allowlist.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,5 +211,67 @@
211211
"status": "ACTIVE",
212212
"reason_to_ignore": "N/A"
213213
}
214+
],
215+
"dpkg": [
216+
{
217+
"description": "It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.",
218+
"vulnerability_id": "CVE-2025-6297",
219+
"name": "CVE-2025-6297",
220+
"package_name": "dpkg",
221+
"package_details": {
222+
"file_path": null,
223+
"name": "dpkg",
224+
"package_manager": "OS",
225+
"version": "1.21.1ubuntu2.3",
226+
"release": null
227+
},
228+
"remediation": {
229+
"recommendation": {
230+
"text": "None Provided"
231+
}
232+
},
233+
"cvss_v3_score": 8.2,
234+
"cvss_v30_score": 0.0,
235+
"cvss_v31_score": 8.2,
236+
"cvss_v2_score": 0.0,
237+
"cvss_v3_severity": "HIGH",
238+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-6297.html",
239+
"source": "UBUNTU_CVE",
240+
"severity": "HIGH",
241+
"status": "ACTIVE",
242+
"title": "CVE-2025-6297 - dpkg, libdpkg-perl",
243+
"reason_to_ignore": "N/A"
244+
}
245+
],
246+
"libdpkg-perl": [
247+
{
248+
"description": "It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.",
249+
"vulnerability_id": "CVE-2025-6297",
250+
"name": "CVE-2025-6297",
251+
"package_name": "libdpkg-perl",
252+
"package_details": {
253+
"file_path": null,
254+
"name": "libdpkg-perl",
255+
"package_manager": "OS",
256+
"version": "1.21.1ubuntu2.3",
257+
"release": null
258+
},
259+
"remediation": {
260+
"recommendation": {
261+
"text": "None Provided"
262+
}
263+
},
264+
"cvss_v3_score": 8.2,
265+
"cvss_v30_score": 0.0,
266+
"cvss_v31_score": 8.2,
267+
"cvss_v2_score": 0.0,
268+
"cvss_v3_severity": "HIGH",
269+
"source_url": "https://people.canonical.com/~ubuntu-security/cve/2025/CVE-2025-6297.html",
270+
"source": "UBUNTU_CVE",
271+
"severity": "HIGH",
272+
"status": "ACTIVE",
273+
"title": "CVE-2025-6297 - dpkg, libdpkg-perl",
274+
"reason_to_ignore": "N/A"
275+
}
214276
]
215277
}

0 commit comments

Comments
 (0)