CVE-2007-4559

Advisory

Anomalib 0.5.0 includes a fix for CVE-2007-4559: Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Added

- 📚 Add OpenVINO Inference to getting started notebook. by samet-akcay in https://github.com/openvinotoolkit/anomalib/pull/897
- Mvtec 3d by alexriedel1 in https://github.com/openvinotoolkit/anomalib/pull/907
- MVTec 3D and Folder3D by alexriedel1 in https://github.com/openvinotoolkit/anomalib/pull/942
- add reorder=True argument in aupro by triet1102 in https://github.com/openvinotoolkit/anomalib/pull/944
- always reorder inputs when computing AUROC by djdameln in https://github.com/openvinotoolkit/anomalib/pull/945
- always reorder for aupr metric by triet1102 in https://github.com/openvinotoolkit/anomalib/pull/975
- Add `README.md` files to `notebooks` directories and its subdirectories (<https://github.com/openvinotoolkit/anomalib/issues/993>)
- Set transformations from the config file by alexriedel1 in https://github.com/openvinotoolkit/anomalib/pull/990
- Add contributors to `README.md` by samet-akcay in https://github.com/openvinotoolkit/anomalib/pull/995
- Add codeowners file by samet-akcay in https://github.com/openvinotoolkit/anomalib/pull/1019
- Configure reference frame for multi-frame video clips by djdameln in https://github.com/openvinotoolkit/anomalib/pull/1023
- [Algo] Attribute-based Representations for Accurate and Interpretable Video Anomaly Detection by djdameln in https://github.com/openvinotoolkit/anomalib/pull/1040

Changed

- Switch to src layout by samet-akcay in https://github.com/openvinotoolkit/anomalib/pull/921
- Remove `config` flag from `OpenVINOInferencer` (<https://github.com/openvinotoolkit/anomalib/pull/939>)
- Add ruff as the main linter by samet-akcay in https://github.com/openvinotoolkit/anomalib/pull/936
- Add a new workflow for code scanning by yunchu in https://github.com/openvinotoolkit/anomalib/pull/940
- Enable bandit scanning by yunchu in https://github.com/openvinotoolkit/anomalib/pull/954
- 🐳 Update Containers and Readme by ashwinvaidya17 in https://github.com/openvinotoolkit/anomalib/pull/952
- Refactor AUPRO metric by triet1102 in https://github.com/openvinotoolkit/anomalib/pull/991
- enable auto-fixing for ruff in pre-commit by djdameln in https://github.com/openvinotoolkit/anomalib/pull/1004
- Refactor strings and ints into enum.Enum by WenjingKangIntel in https://github.com/openvinotoolkit/anomalib/pull/1044
- Modify codecov upload by ashwinvaidya17 in https://github.com/openvinotoolkit/anomalib/pull/1080

Deprecated

- Remove torchvision and torchtext by samet-akcay in https://github.com/openvinotoolkit/anomalib/pull/903
- Remove codacy from ci docs by ashwinvaidya17 in https://github.com/openvinotoolkit/anomalib/pull/924
- Remove config dependency from `OpenVINOInferencer` by samet-akcay in https://github.com/openvinotoolkit/anomalib/pull/939
- Remove config from torch inferencer by samet-akcay in https://github.com/openvinotoolkit/anomalib/pull/1001

 Fixed

- Bugfix code logic to allow for passing of `nn.Module` to `TorchFXFeatureExtractor` by ORippler in https://github.com/openvinotoolkit/anomalib/pull/935
- fix broken links to tutorials (ex guides) by sergiev in https://github.com/openvinotoolkit/anomalib/pull/957
- Fixed outdated info in readme by blaz-r in https://github.com/openvinotoolkit/anomalib/pull/969
- Fix ruff isort integration by samet-akcay in https://github.com/openvinotoolkit/anomalib/pull/976
- Fix/samples dataframe annotation by samet-akcay in https://github.com/openvinotoolkit/anomalib/pull/981
- Fixed openvino_inferencer in gradio_inference by blaz-r in https://github.com/openvinotoolkit/anomalib/pull/972
- Fix issue in tutorial by Ravindu987 in https://github.com/openvinotoolkit/anomalib/pull/997
- Fix tarfile vulnerability by djdameln in https://github.com/openvinotoolkit/anomalib/pull/1003
- Cuda 11.4 dockerfile fix by phcarval in https://github.com/openvinotoolkit/anomalib/pull/1021
- Make anomalib PEP 561 compliant for mypy by WenjingKangIntel in https://github.com/openvinotoolkit/anomalib/pull/1038
- [Bug: 839] Crop in SSPCAB implementation by isaacncz in https://github.com/openvinotoolkit/anomalib/pull/1057
- [Bug: 865] datamodule.setup() assertion failed by isaacncz in https://github.com/openvinotoolkit/anomalib/pull/1058
- Fix logger message for test_split_ratio by ugotsoul in https://github.com/openvinotoolkit/anomalib/pull/1071
- Fix notebook readme formatting by samet-akcay in https://github.com/openvinotoolkit/anomalib/pull/1075

New Contributors

- triet1102 made their first contribution in https://github.com/openvinotoolkit/anomalib/pull/944
- sergiev made their first contribution in https://github.com/openvinotoolkit/anomalib/pull/957
- blaz-r made their first contribution in https://github.com/openvinotoolkit/anomalib/pull/969
- ineiti made their first contribution in https://github.com/openvinotoolkit/anomalib/pull/987
- Ravindu987 made their first contribution in https://github.com/openvinotoolkit/anomalib/pull/997
- phcarval made their first contribution in https://github.com/openvinotoolkit/anomalib/pull/1021
- WenjingKangIntel made their first contribution in https://github.com/openvinotoolkit/anomalib/pull/1038
- isaacncz made their first contribution in https://github.com/openvinotoolkit/anomalib/pull/1057
- ugotsoul made their first contribution in https://github.com/openvinotoolkit/anomalib/pull/1071

**Full Changelog**: https://github.com/openvinotoolkit/anomalib/compare/v0.4.0...v0.5.0

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4559
• http://mail.python.org/pipermail/python-dev/2007-August/074290.html
• http://mail.python.org/pipermail/python-dev/2007-August/074292.html
• https://bugzilla.redhat.com/show_bug.cgi?id=263261
• http://secunia.com/advisories/26623
• http://www.vupen.com/english/advisories/2007/3022