autozeekwatch (>=0.1.0, <=0.1.3), azureml-evaluate-mlflow (>=0.0.4, <=0.0.36) +38 more potentially affected by CVE-2023-6014 via mlflow (>=2.0.0rc0, <=2.7.1)

mlflow PYPI version =2.0.0rc0, =0.1.0, =0.0.4, =0.1.2, =0.8.0, =0.0.1, =0.0.9, =1.0.16, =0.0.1, =1.10.2, =0.7.0, =0.2.0rc0, =1.0.3, =1.0.0a0.post2, =2.0.0 and more Source cves: CVE-2023-6014 Source advisory: OSV:GHSA-4QQ5-MXXX-M6GG...

autozeekwatch (>=0.1.0, <=0.1.3), azureml-evaluate-mlflow (>=0.0.4, <=0.0.36) +38 more potentially affected by CVE-2023-6014 via mlflow (>=2.0.0rc0, <=2.7.1)

mlflow PYPI version =2.0.0rc0, =0.1.0, =0.0.4, =0.1.2, =0.8.0, =0.0.1, =0.0.9, =1.0.16, =0.0.1, =1.10.2, =0.7.0, =0.2.0rc0, =1.0.3, =1.0.0a0.post2, =2.0.0 and more Source cves: CVE-2023-6014 Source advisory: GHSA-4QQ5-MXXX-M6GG...

CVE-2023-6014

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment...

CVE-2023-6014

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment...

Authentication flaw

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment...

CVE-2023-6014

CVE-2023-6014 affects MLflow and describes an authentication bypass that lets an attacker arbitrarily create accounts via the MLflow server/UI without credentials. Documentation in connected sources confirms the vulnerability stems from bypassing MLflow’s authentication mechanism (basic auth path...

CVE-2023-6014 MLflow Authentication Bypass

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment...

CVE-2023-6014

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +166 more potentially affected by CVE-2023-6014 via mlflow (>=0.8.2, <=2.7.1)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =0.1.2, =0.1.0, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =3.0.0, =0.1.2, =0.3.5, =0.8.0, =0.8.0, =0.9.18 and more Source cves: CVE-2023-6014 Source advisory: MEND:CVE-2023-6014...

GHSA-F798-QM4R-23R5 MLflow allowed arbitrary files to be PUT onto the server

MLflow allowed arbitrary files to be PUT onto the server...

azureml-contrib-run (>=1.0.18.2, <=1.0.21.1) potentially affected by CVE-2023-6018 via mlflow (0.8.2)

mlflow PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.18.2, =1.0.21.1 Source cves: CVE-2023-6018 Source advisory: OSV:GHSA-5P3H-7FWH-92RC...

azureml-contrib-run (>=1.0.18.2, <=1.0.21.1) potentially affected by CVE-2023-6015 via mlflow (0.8.2)

mlflow PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.18.2, =1.0.21.1 Source cves: CVE-2023-6015 Source advisory: OSV:GHSA-F798-QM4R-23R5...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2023-6018 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2023-6018 Source advisory: OSV:GHSA-5P3H-7FWH-92RC...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2023-6015 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2023-6015 Source advisory: OSV:GHSA-F798-QM4R-23R5...

azureml-contrib-run (>=1.0.33, <=1.0.41), azureml-mlflow (1.0.41) potentially affected by CVE-2023-6018 via mlflow (0.9.1)

mlflow PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.33, =1.0.41 - azureml-mlflow 1.0.41 Source cves: CVE-2023-6018 Source advisory: OSV:GHSA-5P3H-7FWH-92RC...

azureml-contrib-run (>=1.0.33, <=1.0.41), azureml-mlflow (1.0.41) potentially affected by CVE-2023-6015 via mlflow (0.9.1)

mlflow PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.33, =1.0.41 - azureml-mlflow 1.0.41 Source cves: CVE-2023-6015 Source advisory: OSV:GHSA-F798-QM4R-23R5...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2023-6018 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2023-6018 Source advisory: OSV:GHSA-5P3H-7FWH-92RC...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2023-6015 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2023-6015 Source advisory: OSV:GHSA-F798-QM4R-23R5...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2023-6018 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2023-6018 Source advisory: OSV:GHSA-5P3H-7FWH-92RC...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2023-6015 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2023-6015 Source advisory: OSV:GHSA-F798-QM4R-23R5...