[AUTO-CHERRYPICK] [AutoPR- Security] Patch keras for CVE-2025-9905, CVE-2025-9906 [HIGH] - branch 3.0-dev (microsoft#14724)

Signed-off-by: Kanishk Bansal <[email protected]>
Co-authored-by: Azure Linux Security Servicing Account <[email protected]>
Co-authored-by: Kanishk Bansal <[email protected]>
Co-authored-by: akhila-guruju <[email protected]>

Author: 4 people

SPECS/keras/CVE-2025-8747.patch

@@ -1,12 +1,11 @@
-From eec0ac4143c01736700e50c87112d8687e1cc151 Mon Sep 17 00:00:00 2001
+From 3d6022ab4b79367911cede68a550bfd5b61e2f6d Mon Sep 17 00:00:00 2001
 From: hertschuh <[email protected]>
 Date: Mon, 23 Jun 2025 18:36:47 -0700
-Subject: [PATCH 1/2] Disable loading functions within deserialization.
- (#21412)
-
-Upstream source link: https://github.com/keras-team/keras/commit/3d6022ab4b79367911cede68a550bfd5b61e2f6d.patch
+Subject: [PATCH 1/2] Disable loading functions within deserialization. (#21412)
 
 Loading files while loading a model is not allowed.
+
+Upstream Patch Reference: https://github.com/keras-team/keras/commit/3d6022ab4b79367911cede68a550bfd5b61e2f6d.patch
 ---
  keras/src/saving/serialization_lib.py | 35 +++++++++++++++++++++------
  1 file changed, 27 insertions(+), 8 deletions(-)
@@ -65,24 +64,25 @@ index ed9f10b..1c47b70 100644
              if obj is not None:
                  return obj
 -- 
-2.34.1
-
+2.43.0
 
-From d64692c8d18ea3a4a253159b3f25bc6c06cec6be Mon Sep 17 00:00:00 2001
-From: hertschuh <[email protected]>
-Date: Sun, 29 Jun 2025 10:32:40 -0700
-Subject: [PATCH 2/2] Only allow deserialization of `KerasSaveable`s by module
- and name. (#21429)
 
-Upstream source link: https://github.com/keras-team/keras/commit/713172ab56b864e59e2aa79b1a51b0e728bba858.patch
-Backported by <[email protected]> for azurelinux
+From c69516b50242c568d591353627c895e561350215 Mon Sep 17 00:00:00 2001
+From: Fabien Hertschuh <[email protected]>
+Date: Fri, 27 Jun 2025 10:10:39 -0700
+Subject: [PATCH 2/2] Only allow deserialization of `KerasSaveable`s by module and name.
 
 Arbitrary functions and classes are not allowed.
 
 - Made `Operation` extend `KerasSaveable`, this required moving imports to avoid circular imports
 - `Layer` no longer need to extend `KerasSaveable` directly
 - Made feature space `Cross` and `Feature` extend `KerasSaveable`
 - Also dissallow public function `enable_unsafe_deserialization`
+
+Modified to apply to Azure Linux
+Modified by: Akhila Guruju <[email protected]>
+
+Upstream Patch Reference: https://github.com/keras-team/keras/commit/c69516b50242c568d591353627c895e561350215.patch
 ---
  keras/src/layers/layer.py                     |  3 +-
  .../src/layers/preprocessing/feature_space.py | 11 ++++--
@@ -258,7 +258,7 @@ index 10b79d5..6c738f3 100644
      def _post_build(self):
          """Can be overridden for per backend post build actions."""
 diff --git a/keras/src/saving/saving_lib.py b/keras/src/saving/saving_lib.py
-index c16d2ff..e71e33b 100644
+index c16d2ff..94b9561 100644
 --- a/keras/src/saving/saving_lib.py
 +++ b/keras/src/saving/saving_lib.py
 @@ -12,14 +12,9 @@ import numpy as np
@@ -284,7 +284,7 @@ index c16d2ff..e71e33b 100644
 +        from keras.src.ops.operation import Operation
 +
 +        ref_obj = Operation()
-+        skipset.update(dir(ref_obj))
++        skiplist += dir(ref_obj)
      if obj_type == "Layer":
 +        from keras.src.layers.layer import Layer
 +
@@ -322,12 +322,12 @@ index c16d2ff..e71e33b 100644
 +        from keras.src.layers.preprocessing.feature_space import Cross
 +
 +        ref_obj = Cross((), 1)
-+        skipset.update(dir(ref_obj))
++        skiplist += dir(ref_obj)
 +    elif obj_type == "Feature":
 +        from keras.src.layers.preprocessing.feature_space import Feature
 +
 +        ref_obj = Feature("int32", lambda x: x, "int")
-+        skipset.update(dir(ref_obj))
++        skiplist += dir(ref_obj)
      else:
          raise ValueError(
              f"get_attr_skiplist got invalid {obj_type=}. "
@@ -374,5 +374,5 @@ index 1c47b70..e680d04 100644
                  raise TypeError(
                      f"Could not deserialize {obj_type} '{name}' because "
 -- 
-2.34.1
+2.43.0