CVE-2023-3765: Absolute Path Traversal

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0...

Mlflow security vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in mlflow versions prior to 2.5.0, which stems from the presence of path traversal in the validatepathissafe function...

PT-2023-3707 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: MLflow versions prior to 2.5.0 Description: The issue exists due to incorrect restriction of the path name to a directory with limited access in the validate path is safe function of the MLflow platform. This can allow a remote attacker to...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability exists because the library does not properly validate the source URLs, allowing an attacker to access files outside the expected directory and read arbitrary files through the relative path such as \..\filename...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability exists because the handlers.py does not properly sanitize the path parameter, which allows an attacker to access files outside the expected directory and read arbitrary files through the /get-artifact API endpoint...

mlflow Path Traversal vulnerability

mlflow prior to 2.3.0 is vulnerable to path traversal due to a bypass of the fix for CVE-2023-1177...

GHSA-WJQ3-7JXX-WHJ9 mlflow Path Traversal vulnerability

mlflow prior to 2.3.0 is vulnerable to path traversal due to a bypass of the fix for CVE-2023-1177...

azureml-contrib-run (>=1.0.18.2, <=1.0.21.1) potentially affected by CVE-2023-2780 via mlflow (0.8.2)

mlflow PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.18.2, =1.0.21.1 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2023-2780 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

azureml-contrib-run (>=1.0.33, <=1.0.41), azureml-mlflow (1.0.41) potentially affected by CVE-2023-2780 via mlflow (0.9.1)

mlflow PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.33, =1.0.41 - azureml-mlflow 1.0.41 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2023-2780 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2023-2780 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

azureml-contrib-run (>=1.0.72, <=1.0.74), azureml-mlflow (>=1.0.72.1, <=1.0.74) potentially affected by CVE-2023-2780 via mlflow (1.3.0)

mlflow PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.72, =1.0.72.1, =1.0.74 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-2780 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

deepsleep (1.0.3) potentially affected by CVE-2023-2780 via mlflow (1.5.0)

mlflow PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - deepsleep 1.0.3 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

dbnd-mlflow (>=0.25.14, <=0.81.4), nerblackbox (>=0.0.5, <=0.0.10) potentially affected by CVE-2023-2780 via mlflow (1.6.0)

mlflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dbnd-mlflow =0.25.14, =0.0.5, =0.0.10 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2023-2780 via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

nerblackbox (>=0.0.11, <=0.0.13), qacaller (>=0.0.1, <=0.1.2) potentially affected by CVE-2023-2780 via mlflow (1.8.0)

mlflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - nerblackbox =0.0.11, =0.0.1, =0.1.2 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2023-2780 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...

layer-client (0.3.5), sapsan (>=0.1.1, <=0.2.7) potentially affected by CVE-2023-2780 via mlflow (1.11.0)

mlflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.5 - sapsan =0.1.1, =0.2.7 Source cves: CVE-2023-2780 Source advisory: OSV:GHSA-WJQ3-7JXX-WHJ9...