CVE-2024-37055: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37052: Deserialization of Untrusted Data

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

GHSA-9WX4-H78V-VM56 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, az, patroni, airflow, nvidia-nsight-compute-13.2, py3-cassandra-medusa, jwt-tool, kubeflow-katib, kubeflow-pipelines-visualization-server, kubeflow-jupyter-web-app, request-1276, py3-pipenv, confluent-docker-utils, kubeflow-pipelines,...

Improper Access Control

mlflow is vulnerable to Improper Access Control. The vulnerability is due to improper validation of DELETE requests by users with EDIT permissions, allowing unauthorized deletions of artifacts...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability is due to improper validation of artifact URLs, particularly in handling the fragment part of the URL. Attackers can exploit this by inserting a 'character, allowing the artifact to bypass validation, resulting an arbitrary file access on...

GHSA-P4JX-Q62P-X5JR MLflow allows low privilege users to delete any artifact

A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2024-4263 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

azureml-contrib-run (>=1.0.33, <=1.0.41), azureml-mlflow (1.0.41) potentially affected by CVE-2024-4263 via mlflow (0.9.1)

mlflow PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.33, =1.0.41 - azureml-mlflow 1.0.41 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2024-4263 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

azureml-contrib-run (>=1.0.72, <=1.0.74), azureml-mlflow (>=1.0.72.1, <=1.0.74) potentially affected by CVE-2024-4263 via mlflow (1.3.0)

mlflow PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.72, =1.0.72.1, =1.0.74 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-4263 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

deepsleep (1.0.3) potentially affected by CVE-2024-4263 via mlflow (1.5.0)

mlflow PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - deepsleep 1.0.3 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2024-4263 via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2024-4263 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

mlflow-dl (>=0.2.0, <=0.2.2), mlsriracha (0.0.2) +1 more potentially affected by CVE-2024-4263 via mlflow (1.19.0)

mlflow PYPI version 1.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-dl =0.2.0, =0.1.0, =2.0.8 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

biome-text (3.3.0), elemeno-ai-sdk (>=0.0.8, <=0.2.4) +5 more potentially affected by CVE-2024-4263 via mlflow (1.20.2)

mlflow PYPI version 1.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text 3.3.0 - elemeno-ai-sdk =0.0.8, =0.0.1, =0.2.1.2, =0.1.5, =2.5.1a1, =0.0.1, =0.0.48 Source cves: CVE-2024-4263 Source advisory:...

mlflow-asus-aimaker (>=0.0.6, <=1.0.2), newsmodel (0.1.0) +3 more potentially affected by CVE-2024-4263 via mlflow (1.24.0)

mlflow PYPI version 1.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-asus-aimaker =0.0.6, =1.3.0, =3.1.1, =3.1.4, =3.1.6 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

sapsan (>=0.6.1, <=0.6.2) potentially affected by CVE-2024-4263 via mlflow (1.25.0)

mlflow PYPI version 1.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - sapsan =0.6.1, =0.6.2 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

dagster-mlflow (>=0.14.18rc5, <=0.17.21), sparkpipelineframework (1.0.18) potentially affected by CVE-2024-4263 via mlflow (1.26.0)

mlflow PYPI version 1.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.14.18rc5, =0.17.21 - sparkpipelineframework 1.0.18 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...

a2 (>=0.1.0, <=0.3.17), ikomia (>=0.9.0, <=0.13.0) +2 more potentially affected by CVE-2024-4263 via mlflow (1.30.0)

mlflow PYPI version 1.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - a2 =0.1.0, =0.9.0, =0.13.0 - mantik 0.1.2 - pyrovelocity 0.1.1 Source cves: CVE-2024-4263 Source advisory: OSV:GHSA-P4JX-Q62P-X5JR...