CVE-2021-35958: 
TensorFlow vulnerability analysis and mitigation

TensorFlow through 2.5.0 contains a vulnerability in the tf.keras.utils.getfile function when used with extract=True parameter. This function allows attackers to overwrite arbitrary files via a crafted archive. The vulnerability was discovered and disclosed on June 29, 2021. However, this vulnerability is disputed as the vendor's position is that tf.keras.utils.getfile is not intended for untrusted archives (MITRE, NVD).

The vulnerability exists in the get_file function of TensorFlow's Keras utility module when the extract parameter is set to True. The function fails to properly validate archive contents before extraction, which could allow path traversal attacks through crafted archive files (RyotaK).

If exploited, this vulnerability could allow an attacker to overwrite arbitrary files on the system through a specially crafted archive file when processed by the tf.keras.utils.get_file function with extract=True parameter (RyotaK).

The recommended mitigation is to avoid using tf.keras.utils.get_file with extract=True parameter on untrusted archive files. Security-conscious users should verify archive contents before extraction (RyotaK).