sapsan (>=0.6.1, <=0.6.2) potentially affected by CVE-2023-6909 via mlflow (1.25.0)

mlflow PYPI version 1.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - sapsan =0.6.1, =0.6.2 Source cves: CVE-2023-6909 Source advisory: OSV:PYSEC-2023-252...

openstef (>=3.2.0a0, <=3.2.6) potentially affected by CVE-2023-6909 via mlflow (1.25.1)

mlflow PYPI version 1.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - openstef =3.2.0a0, =3.2.6 Source cves: CVE-2023-6909 Source advisory: OSV:PYSEC-2023-252...

dagster-mlflow (>=0.14.18rc5, <=0.17.21), sparkpipelineframework (1.0.18) potentially affected by CVE-2023-6909 via mlflow (1.26.0)

mlflow PYPI version 1.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.14.18rc5, =0.17.21 - sparkpipelineframework 1.0.18 Source cves: CVE-2023-6909 Source advisory: OSV:PYSEC-2023-252...

dagster-mlflow (>=0.18.0, <=0.18.3), dbx (0.5.0) +13 more potentially affected by CVE-2023-6909 via mlflow (1.26.1)

mlflow PYPI version 1.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.18.0, =0.2.5, =0.0.1, =0.3.3, =0.2.0.dev3, =0.2.0.dev2, =0.40.2.dev25, =0.40.2.dev18, =0.39.1rc2, =3.2.7, =0.0.1, =0.1.2, =0.2.1...

dagster-mlflow (>=0.19.11, <=0.21.4), databricks-session (0.1.9) +14 more potentially affected by CVE-2023-6909 via mlflow (1.27.0)

mlflow PYPI version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.19.11, =0.3.0, =0.0.4.dev3, =3.0.1, =4.0.2, =0.1.0, =3.2.18, =0.1.0, =0.0.1.dev202206240024, =0.1.0, =0.1.5 and more Source cves:...

azureml-evaluate-mlflow (>=0.0.1, <=0.0.2), ride-duration-prediction-sunxi1010 (0.3.0) +1 more potentially affected by CVE-2023-6909 via mlflow (1.28.0)

mlflow PYPI version 1.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.1, =0.0.1, =0.3.4 Source cves: CVE-2023-6909 Source advisory: OSV:PYSEC-2023-252...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2023-6909 via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2023-6909 Source advisory: OSV:PYSEC-2023-252...

a2 (>=0.1.0, <=0.3.17), ikomia (>=0.9.0, <=0.13.0) +2 more potentially affected by CVE-2023-6909 via mlflow (1.30.0)

mlflow PYPI version 1.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - a2 =0.1.0, =0.9.0, =0.13.0 - mantik 0.1.2 - pyrovelocity 0.1.1 Source cves: CVE-2023-6909 Source advisory: OSV:PYSEC-2023-252...

cnext (>=0.3.5, <=0.3.8), code-first-pipelines (>=0.8.0, <=1.0.0) +51 more potentially affected by CVE-2023-6909 via mlflow (1.30.1)

mlflow PYPI version 1.30.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - cnext =0.3.5, =0.8.0, =0.6.1rc1, =0.2.4, =0.24.24, =0.0.1a0, =1.0.1, =0.1.1, =0.3.0, =0.8.3, =0.48.0, =0.2.0, =0.2.0, =0.3.0 and more Source cves:...

autopilotml (>=1.0.1, <=1.0.14), autozeekwatch (>=0.1.0, <=0.1.3) +42 more potentially affected by CVE-2023-6909 via mlflow (>=2.0.0rc0, <=2.8.1)

mlflow PYPI version =2.0.0rc0, =1.0.1, =0.1.0, =0.0.4, =0.1.2, =0.8.0, =0.0.1, =0.0.9, =1.0.16, =0.0.1, =1.10.2, =0.7.0, =0.2.0rc0, =1.0.3, =1.2.6 and more Source cves: CVE-2023-6909 Source advisory: OSV:PYSEC-2023-252...

PYSEC-2023-252

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6909 Path Traversal: '\..\filename' in mlflow/mlflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6909 Path Traversal: '\..\filename' in mlflow/mlflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-6909

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +170 more potentially affected by CVE-2023-6909 via mlflow (>=0.8.2, <=2.8.1)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =1.0.1, =0.1.2, =0.1.0, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =3.0.0, =0.1.2, =0.3.5, =0.8.0, =1.0.0 - cortic 0.1.0 and more Source cves: CVE-2023-6909 Source advisory: MEND:CVE-2023-6909...

CVE-2023-6909

Mlflow up to version 2.9.2 is affected by CVE-2023-6909: a path traversal in the repository mlflow/mlflow allows escaping to read sensitive files via the sequence \..\filename. The vulnerability affects the mlflow/mlflow project prior to 2.9.2 and is classified as CWE-29. Impact in the NVD/NVD-de...

mlflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in mlflow versions prior to 2.9.2 that stems from the presence of a path traversal issue...

CVE-2023-6909: Path Traversal: '\..\filename'

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

PT-2023-32825

Name of the Vulnerable Software and Affected Versions MLflow affected versions not specified Description The issue allows attackers to gain full command execution on the victim system with only one user interaction, which involves downloading a malicious config. This is related to a Command...

PT-2023-32817 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow versions prior to 2.9.2 Description: The issue concerns a path traversal vulnerability. It involves the use of '..filename' in the GitHub repository mlflow/mlflow. Recommendations: For versions prior to 2.9.2, update to version 2.9.2 o...