mlflow Command Injection Vulnerability

Mlflow is an open source platform for machine learning lifecycles. Mlflow suffers from a command injection vulnerability that stems from the ability to bypass the jinja2 SSTI, which can be exploited by an attacker to gain full command execution privileges on the victim's system...

Path traversal in MLflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

GHSA-554W-XH4J-8W64 Path traversal in MLflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

azureml-contrib-run (>=1.0.18.2, <=1.0.21.1) potentially affected by CVE-2023-6831 via mlflow (0.8.2)

mlflow PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.18.2, =1.0.21.1 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

azureml-contrib-run (>=1.0.23, <=1.0.30.1) potentially affected by CVE-2023-6831 via mlflow (0.9.0)

mlflow PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.23, =1.0.30.1 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

azureml-contrib-run (>=1.0.33, <=1.0.41), azureml-mlflow (1.0.41) potentially affected by CVE-2023-6831 via mlflow (0.9.1)

mlflow PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.33, =1.0.41 - azureml-mlflow 1.0.41 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2023-6831 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2023-6831 via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

azureml-contrib-run (>=1.0.72, <=1.0.74), azureml-mlflow (>=1.0.72.1, <=1.0.74) potentially affected by CVE-2023-6831 via mlflow (1.3.0)

mlflow PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.72, =1.0.72.1, =1.0.74 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-6831 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

deepsleep (1.0.3) potentially affected by CVE-2023-6831 via mlflow (1.5.0)

mlflow PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - deepsleep 1.0.3 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

dbnd-mlflow (>=0.25.14, <=0.81.4), nerblackbox (>=0.0.5, <=0.0.10) potentially affected by CVE-2023-6831 via mlflow (1.6.0)

mlflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dbnd-mlflow =0.25.14, =0.0.5, =0.0.10 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2023-6831 via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

nerblackbox (>=0.0.11, <=0.0.13), qacaller (>=0.0.1, <=0.1.2) potentially affected by CVE-2023-6831 via mlflow (1.8.0)

mlflow PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - nerblackbox =0.0.11, =0.0.1, =0.1.2 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2023-6831 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2023-6831 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

layer-client (0.3.5), sapsan (>=0.1.1, <=0.2.7) potentially affected by CVE-2023-6831 via mlflow (1.11.0)

mlflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.5 - sapsan =0.1.1, =0.2.7 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2023-6831 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2023-6831 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...

biome-text (>=3.0.0, <=3.2.1), farm (>=0.6.2, <=0.8.0) +5 more potentially affected by CVE-2023-6831 via mlflow (1.13.1)

mlflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text =3.0.0, =0.6.2, =0.7.0, =0.0.1, =1.1.0, =1.0.0, =0.4.5.dev2, =0.6.5 Source cves: CVE-2023-6831 Source advisory: OSV:GHSA-554W-XH4J-8W64...