CVE-2023-4033 OS Command Injection in mlflow/mlflow

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0...

CVE-2023-4033

CVE-2023-4033 : The connected documents confirm an OS Command Injection vulnerability affecting the project mlflow/mlflow prior to version 2.6.0 . The sources (OSV, GHSA, NVD, and related advisories) consistently describe it as an OS command injection issue in that repository/version range. The d...

CVE-2023-4033 OS Command Injection in mlflow/mlflow

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0...

CVE-2023-4033

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +160 more potentially affected by CVE-2023-4033 via mlflow (>=0.8.2, <=2.5.0)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =0.1.2, =0.1.0, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =3.0.0, =0.1.2, =0.3.5, =0.8.0, =0.8.0, =0.9.18 and more Source cves: CVE-2023-4033 Source advisory: MEND:CVE-2023-4033...

CVE-2023-4033 OS Command Injection in mlflow/mlflow

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0...

CVE-2023-4033: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0...

Mlflow operating system command injection vulnerability

Mlflow is an open source platform for machine learning lifecycle. An operating system command injection vulnerability exists in Mlflow versions prior to 2.6.0, which stems from vulnerability to operating system command injection attacks...

Path Traversal

mlflow is vulnerable to Path Traversal. An attacker is able to use faulty path validation middleware to get around security measures on Windows hosts and take complete control of the host's file system. This enables absolute Windows file paths to be used for file listing, reading, writing, and...

GHSA-FMXJ-6H9G-6VW3 MLflow Path Traversal vulnerability

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0...

azureml-contrib-run (>=1.0.18.2, <=1.0.21.1) potentially affected by CVE-2023-3765 via mlflow (0.8.2)

mlflow PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.18.2, =1.0.21.1 Source cves: CVE-2023-3765 Source advisory: OSV:GHSA-FMXJ-6H9G-6VW3...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2023-3765 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2023-3765 Source advisory: OSV:GHSA-FMXJ-6H9G-6VW3...

azureml-contrib-run (>=1.0.33, <=1.0.41), azureml-mlflow (1.0.41) potentially affected by CVE-2023-3765 via mlflow (0.9.1)

mlflow PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.33, =1.0.41 - azureml-mlflow 1.0.41 Source cves: CVE-2023-3765 Source advisory: OSV:GHSA-FMXJ-6H9G-6VW3...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2023-3765 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2023-3765 Source advisory: OSV:GHSA-FMXJ-6H9G-6VW3...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2023-3765 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2023-3765 Source advisory: OSV:GHSA-FMXJ-6H9G-6VW3...

azureml-contrib-run (>=1.0.72, <=1.0.74), azureml-mlflow (>=1.0.72.1, <=1.0.74) potentially affected by CVE-2023-3765 via mlflow (1.3.0)

mlflow PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.72, =1.0.72.1, =1.0.74 Source cves: CVE-2023-3765 Source advisory: OSV:GHSA-FMXJ-6H9G-6VW3...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-3765 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-3765 Source advisory: OSV:GHSA-FMXJ-6H9G-6VW3...

deepsleep (1.0.3) potentially affected by CVE-2023-3765 via mlflow (1.5.0)

mlflow PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - deepsleep 1.0.3 Source cves: CVE-2023-3765 Source advisory: OSV:GHSA-FMXJ-6H9G-6VW3...

dbnd-mlflow (>=0.25.14, <=0.81.4), nerblackbox (>=0.0.5, <=0.0.10) potentially affected by CVE-2023-3765 via mlflow (1.6.0)

mlflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dbnd-mlflow =0.25.14, =0.0.5, =0.0.10 Source cves: CVE-2023-3765 Source advisory: OSV:GHSA-FMXJ-6H9G-6VW3...

faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2023-3765 via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2023-3765 Source advisory: OSV:GHSA-FMXJ-6H9G-6VW3...