openstef (>=3.2.0a0, <=3.2.6) potentially affected by unknown CVE via mlflow (1.25.1)

mlflow PYPI version 1.25.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - openstef =3.2.0a0, =3.2.6 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

azureml-contrib-run (>=1.0.72, <=1.0.74), azureml-mlflow (>=1.0.72.1, <=1.0.74) potentially affected by unknown CVE via mlflow (1.3.0)

mlflow PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.72, =1.0.72.1, =1.0.74 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by unknown CVE via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

dbnd-mlflow (>=0.25.14, <=0.81.4), nerblackbox (>=0.0.5, <=0.0.10) potentially affected by unknown CVE via mlflow (1.6.0)

mlflow PYPI version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dbnd-mlflow =0.25.14, =0.0.5, =0.0.10 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

deepsleep (1.0.3) potentially affected by unknown CVE via mlflow (1.5.0)

mlflow PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - deepsleep 1.0.3 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by unknown CVE via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

agentos (>=0.0.5, <=0.0.7) potentially affected by unknown CVE via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by unknown CVE via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

cnext (>=0.3.5, <=0.3.8), code-first-pipelines (>=0.8.0, <=1.0.0) +51 more potentially affected by unknown CVE via mlflow (1.30.1)

mlflow PYPI version 1.30.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - cnext =0.3.5, =0.8.0, =0.6.1rc1, =0.2.4, =0.24.24, =0.0.1a0, =1.0.1, =0.1.1, =0.3.0, =0.8.3, =0.48.0, =0.2.0, =0.2.0, =0.3.0 and more Source cves:...

autozeekwatch (>=0.1.0, <=0.1.3), azureml-evaluate-mlflow (>=0.0.4, <=0.0.12) +17 more potentially affected by unknown CVE via mlflow (>=2.0.0rc0, <=2.3.0)

mlflow PYPI version =2.0.0rc0, =0.1.0, =0.0.4, =0.8.0, =0.0.1, =1.10.2, =0.2.0rc0, =1.6.1, =0.2.0, =0.1.0, =1.0.0rc5, =0.1.0, =0.1.7 and more Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by unknown CVE via mlflow (1.29.0)

mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

azureml-evaluate-mlflow (>=0.0.1, <=0.0.2), ride-duration-prediction-sunxi1010 (0.3.0) +1 more potentially affected by unknown CVE via mlflow (1.28.0)

mlflow PYPI version 1.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.1, =0.0.1, =0.3.4 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.3.1 may be vulnerable to a remote file access exploit if they are not limiting who can query their server for example,...

autozeekwatch (>=0.1.0, <=0.1.3), azureml-evaluate-mlflow (>=0.0.4, <=0.0.12) +17 more potentially affected by CVE-2023-1177 via mlflow (>=2.0.0rc0, <=2.3.0)

mlflow PYPI version =2.0.0rc0, =0.1.0, =0.0.4, =0.8.0, =0.0.1, =1.10.2, =0.2.0rc0, =1.6.1, =0.2.0, =0.1.0, =1.0.0rc5, =0.1.0, =0.1.7 and more Source cves: CVE-2023-1177 Source advisory: GHSA-83FM-W79M-64R5...

dagster-mlflow (>=0.18.0, <=0.18.3), dbx (0.5.0) +13 more potentially affected by unknown CVE via mlflow (1.26.1)

mlflow PYPI version 1.26.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.18.0, =0.2.5, =0.0.1, =0.3.3, =0.2.0.dev3, =0.2.0.dev2, =0.40.2.dev25, =0.40.2.dev18, =0.39.1rc2, =3.2.7, =0.0.1, =0.1.2, =0.2.1...

a2 (>=0.1.0, <=0.3.17), ikomia (>=0.9.0, <=0.13.0) +2 more potentially affected by unknown CVE via mlflow (1.30.0)

mlflow PYPI version 1.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - a2 =0.1.0, =0.9.0, =0.13.0 - mantik 0.1.2 - pyrovelocity 0.1.1 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by unknown CVE via mlflow (1.2.0)

mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

biome-text (>=3.0.0, <=3.2.1), farm (>=0.6.2, <=0.8.0) +5 more potentially affected by unknown CVE via mlflow (1.13.1)

mlflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text =3.0.0, =0.6.2, =0.7.0, =0.0.1, =1.1.0, =1.0.0, =0.4.5.dev2, =0.6.5 Source cves: unknown CVE Source advisory: OSV:GHSA-83FM-W79M-64R5...

Multiple command injections in `mlflow models` CLI action

Description The mlflow cli executable is vulnerable to a command injection attack in mlflow models predict and mlflow models serve actions. The aforementioned actions is defined in file mlflow\models\cli.py, and uses a vulnerable predict and serve methods of a dynamically resolved instance of...

Multiple path traversals on Windows hosts

Description validatepathissafe function in file /mlflow/server/handlers.py, introduced in PR 7891 on Feb 24th, 2023 does not account for Windows absolute path format, and thus can be bypassed on MLFlow servers, running on Windows hosts, exposing them to a number of high-impact directory traversal...