CVE-2022-0736

Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1...

agentos (>=0.0.5, <=0.0.7), autorad (0.1.2) +53 more potentially affected by CVE-2022-0736 via mlflow (>=1.0.0, <=1.23.0)

mlflow PYPI version =1.0.0, =0.0.5, =1.0.72, =1.0.72.1, =1.4.0, =3.0.0, =0.25.14, =0.1.3, =0.0.8, =0.0.1, =0.1.0, =0.4.5, =0.3.0, =1.3.0 and more Source cves: CVE-2022-0736 Source advisory: OSV:GHSA-VQJ2-4V8M-8VRQ...

azureml-contrib-run (>=1.0.33, <=1.0.41), azureml-mlflow (1.0.41) potentially affected by CVE-2022-0736 via mlflow (0.9.1)

mlflow PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.33, =1.0.41 - azureml-mlflow 1.0.41 Source cves: CVE-2022-0736 Source advisory: OSV:GHSA-VQJ2-4V8M-8VRQ...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2022-0736 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2022-0736 Source advisory: OSV:GHSA-VQJ2-4V8M-8VRQ...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2022-0736 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2022-0736 Source advisory: OSV:PYSEC-2022-28...

azureml-contrib-run (>=1.0.18.2, <=1.0.21.1) potentially affected by CVE-2022-0736 via mlflow (0.8.2)

mlflow PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.18.2, =1.0.21.1 Source cves: CVE-2022-0736 Source advisory: OSV:PYSEC-2022-28...

agentos (>=0.0.5, <=0.0.7), autorad (0.1.2) +53 more potentially affected by CVE-2022-0736 via mlflow (>=1.0.0, <=1.23.0)

mlflow PYPI version =1.0.0, =0.0.5, =1.0.72, =1.0.72.1, =1.4.0, =3.0.0, =0.25.14, =0.1.3, =0.0.8, =0.0.1, =0.1.0, =0.4.5, =0.3.0, =1.3.0 and more Source cves: CVE-2022-0736 Source advisory: OSV:PYSEC-2022-28...

agentos (>=0.0.5, <=0.0.7), autorad (0.1.2) +53 more potentially affected by CVE-2022-0736 via mlflow (>=0.8.2, <=1.23.0)

mlflow PYPI version =0.8.2, =0.0.5, =1.0.18.2, =1.0.41, =1.4.0, =3.0.0, =0.25.14, =0.1.3, =0.0.8, =0.0.1, =0.1.0, =0.4.5, =0.3.0, =1.3.0 and more Source cves: CVE-2022-0736 Source advisory: MEND:CVE-2022-0736...

CVE-2022-0736

CVE-2022-0736 affects mlflow/mlflow prior to 1.23.1, describing an insecure temporary file issue. The root cause is use of the deprecated tempfile.mktemp() pattern in the affected code, with remediation to upgrade to mlflow 1.23.1 or later as indicated by OSV/GHSA entries. The connected sources c...