PT-2024-27269

Name of the Vulnerable Software and Affected Versions MLflow platform versions 0.9.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user's system when interacted with. Recommendations For MLflo...

CVE-2024-37053: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

PT-2024-27274

Name of the Vulnerable Software and Affected Versions MLflow versions 0.5.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user's system when interacted with. Recommendations For MLflow versio...

PT-2024-27271

Name of the Vulnerable Software and Affected Versions MLflow versions 1.23.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user's system when interacted with. Recommendations Fo...

PT-2024-27276

Name of the Vulnerable Software and Affected Versions MLflow platform versions 1.27.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run. Recommendations For MLflow platform...

PT-2024-27277

Name of the Vulnerable Software and Affected Versions MLflow platform versions 1.11.0 and newer Description Remote Code Execution can occur in the MLflow platform, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run, due to unfiltered input...

CVE-2024-37054: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

PT-2024-27267

Name of the Vulnerable Software and Affected Versions MLflow versions 1.1.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user's system when interacted with. Recommendations For MLflow...

PT-2024-27268

Name of the Vulnerable Software and Affected Versions MLflow versions 1.1.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user's system when interacted with. Recommendations For MLflow...

PT-2024-27270

Name of the Vulnerable Software and Affected Versions MLflow versions 1.24.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user's system when interacted with. Recommendations For versions...

CVE-2024-37059: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37061: Improper Control of Generation of Code

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run...

CVE-2024-37056: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37057: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37058: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37060: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run...

CVE-2024-37055: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with...

PT-2024-27273

Name of the Vulnerable Software and Affected Versions MLflow versions 2.5.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user's system when interacted with. Recommendations F...

CVE-2024-37052: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

GHSA-9WX4-H78V-VM56 vulnerabilities

Vulnerabilities for packages: request-1276, checkov, jwt-tool, kubeflow-pipelines-visualization-server, apache-beam-python-3.11-sdk, k8s-sidecar, kubeflow-jupyter-web-app, confluent-docker-utils, py3-pipenv, superset, ggshield, nvidia-nsight-compute-13.1, kubeflow-volumes-web-app, reflex, patroni...