MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with...

GHSA-WF7F-8FXF-XFXC vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-PQCV-QW2R-R859 vulnerabilities

Vulnerabilities for packages: mlflow...

auf (>=1.0.0, <=2.0.1), auto-mlflow (1.0.0) +45 more potentially affected by CVE-2024-37058 via mlflow (>=2.5.0, <=2.14.1)

mlflow PYPI version =2.5.0, =1.0.0, =1.0.1, =0.0.26, =0.1.3, =1.2.0, =0.9.21, =0.0.10, =0.0.9, =1.0.0, =0.1.0, =0.1.1, =0.1.2, =0.1.4 and more Source cves: CVE-2024-37058 Source advisory: OSV:GHSA-CWGG-W6MP-W9HG...

a2 (>=0.1.0, <=0.3.17), auf (>=1.0.0, <=2.0.1) +183 more potentially affected by CVE-2024-37061 via mlflow (>=1.11.0, <=2.13.1)

mlflow PYPI version =1.11.0, =0.1.0, =1.0.0, =1.0.1, =0.1.2, =0.1.0, =0.0.1, =1.4.0, =0.1.3, =3.0.0, =0.1.2, =0.3.5, =0.8.0, =1.2.0, =1.2.13 and more Source cves: CVE-2024-37061 Source advisory: OSV:GHSA-PQCV-QW2R-R859...

GHSA-PQCV-QW2R-R859 vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-CV6C-7963-WXCG MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run...

GHSA-WF7F-8FXF-XFXC MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...

GHSA-CV6C-7963-WXCG vulnerabilities

Vulnerabilities for packages: mlflow...

a2 (>=0.1.0, <=0.3.17), auf (>=1.0.0, <=2.0.1) +133 more potentially affected by CVE-2024-37060 via mlflow (>=1.27.0, <=2.14.1)

mlflow PYPI version =1.27.0, =0.1.0, =1.0.0, =1.0.1, =0.1.0, =0.0.1, =0.1.3, =0.1.2, =0.3.5, =0.8.0, =1.2.0, =0.8.0, =0.19.11, =0.21.4 and more Source cves: CVE-2024-37060 Source advisory: OSV:GHSA-CV6C-7963-WXCG...

a2 (>=0.1.0, <=0.3.17), auf (>=1.0.0, <=2.0.1) +133 more potentially affected by CVE-2024-37060 via mlflow (>=1.27.0, <=2.14.1)

mlflow PYPI version =1.27.0, =0.1.0, =1.0.0, =1.0.1, =0.1.0, =0.0.1, =0.1.3, =0.1.2, =0.3.5, =0.8.0, =1.2.0, =0.8.0, =0.19.11, =0.21.4 and more Source cves: CVE-2024-37060 Source advisory: GHSA-CV6C-7963-WXCG...

GHSA-CWGG-W6MP-W9HG vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-J8MG-PQC5-X9GJ vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-PQCV-QW2R-R859 MLFlow improper input validation

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run due to unfiltered input...

GHSA-J8MG-PQC5-X9GJ MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with...

a2 (>=0.1.0, <=0.3.17), abnativ (>=1.1.0, <=1.2.9) +353 more potentially affected by CVE-2024-37059 via mlflow (>=0.8.2, <=3.4.0)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =1.0.0, =0.1.0, =1.7.0.dev1715243074, =1.7.0.dev1715246371, =1.8.0rc6, =1.7.0.dev1715246329, =1.7.0.dev1715246310, =0.1.9, =0.1.40 and more Source cves: CVE-2024-37059 Source advisory: OSV:GHSA-WF7F-8FXF-XFXC...

a2 (>=0.1.0, <=0.3.17), abnativ (>=1.1.0, <=1.2.9) +353 more potentially affected by CVE-2024-37059 via mlflow (>=0.8.2, <=3.4.0)

mlflow PYPI version =0.8.2, =0.1.0, =1.1.0, =0.0.5, =0.1.0, =1.0.0, =0.1.0, =1.7.0.dev1715243074, =1.7.0.dev1715246371, =1.8.0rc6, =1.7.0.dev1715246329, =1.7.0.dev1715246310, =0.1.9, =0.1.40 and more Source cves: CVE-2024-37059 Source advisory: GHSA-WF7F-8FXF-XFXC...

auf (>=1.0.0, <=2.0.1), auto-mlflow (1.0.0) +68 more potentially affected by CVE-2024-37057 via mlflow (>=2.0.0rc0, <=2.14.1)

mlflow PYPI version =2.0.0rc0, =1.0.0, =1.0.1, =0.1.0, =0.0.4, =0.1.3, =0.1.2, =1.2.0, =0.8.0, =0.0.10, =0.0.1, =0.0.9, =1.0.16, =1.0.0, =1.0.2 and more Source cves: CVE-2024-37057 Source advisory: OSV:GHSA-J8MG-PQC5-X9GJ...

auf (>=1.0.0, <=2.0.1), auto-mlflow (1.0.0) +68 more potentially affected by CVE-2024-37057 via mlflow (>=2.0.0rc0, <=2.14.1)

mlflow PYPI version =2.0.0rc0, =1.0.0, =1.0.1, =0.1.0, =0.0.4, =0.1.3, =0.1.2, =1.2.0, =0.8.0, =0.0.10, =0.0.1, =0.0.9, =1.0.16, =1.0.0, =1.0.2 and more Source cves: CVE-2024-37057 Source advisory: GHSA-J8MG-PQC5-X9GJ...