farm (>=0.4.5, <=0.6.1), farm-haystack (>=0.3.0, <=0.6.0) +2 more potentially affected by CVE-2023-2356 via mlflow (1.0.0)

mlflow PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - farm =0.4.5, =0.3.0, =0.0.1a1.dev14, =0.0.1a1.dev15 - mlflow-faculty 0.3.1 Source cves: CVE-2023-2356 Source advisory: OSV:PYSEC-2023-68...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2023-2356 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2023-2356 Source advisory: OSV:PYSEC-2023-68...

ml-deploy (2.0.0), waveletai (>=0.2.5, <=0.2.11) potentially affected by CVE-2023-2356 via mlflow (1.18.0)

mlflow PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-deploy 2.0.0 - waveletai =0.2.5, =0.2.11 Source cves: CVE-2023-2356 Source advisory: OSV:PYSEC-2023-68...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2023-2356 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2023-2356 Source advisory: OSV:PYSEC-2023-68...

dagster-mlflow (>=0.14.18rc5, <=0.17.21), sparkpipelineframework (1.0.18) potentially affected by CVE-2023-2356 via mlflow (1.26.0)

mlflow PYPI version 1.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.14.18rc5, =0.17.21 - sparkpipelineframework 1.0.18 Source cves: CVE-2023-2356 Source advisory: OSV:PYSEC-2023-68...

agentos (>=0.0.5, <=0.0.7) potentially affected by CVE-2023-2356 via mlflow (1.9.1)

mlflow PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - agentos =0.0.5, =0.0.7 Source cves: CVE-2023-2356 Source advisory: OSV:PYSEC-2023-68...

biome-text (>=3.0.0, <=3.2.1), farm (>=0.6.2, <=0.8.0) +5 more potentially affected by CVE-2023-2356 via mlflow (1.13.1)

mlflow PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text =3.0.0, =0.6.2, =0.7.0, =0.0.1, =1.1.0, =1.0.0, =0.4.5.dev2, =0.6.5 Source cves: CVE-2023-2356 Source advisory: OSV:PYSEC-2023-68...

CVE-2023-2356: Relative Path Traversal

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...

CVE-2023-2356 Relative Path Traversal in mlflow/mlflow

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...

CVE-2023-2356 Relative Path Traversal in mlflow/mlflow

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...

CVE-2023-2356 Relative Path Traversal in mlflow/mlflow

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...

a2 (>=0.1.0, <=0.3.17), agentos (>=0.0.5, <=0.0.7) +149 more potentially affected by CVE-2023-2356 via mlflow (>=0.8.2, <=2.3.0)

mlflow PYPI version =0.8.2, =0.1.0, =0.0.5, =0.1.2, =0.1.0, =1.0.18.2, =0.0.1, =1.0.41, =1.4.0, =3.0.0, =0.3.5, =0.8.0, =0.8.0, =0.14.18rc5, =0.6.1rc1, =0.6.1 and more Source cves: CVE-2023-2356 Source advisory: MEND:CVE-2023-2356...

CVE-2023-2356

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...

PT-2023-19040 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow versions prior to 2.3.1 Description: The issue is related to a Relative Path Traversal in the GitHub repository mlflow/mlflow. Recommendations: For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue...

CVE-2023-2356

CVE-2023-2356 is a Relative Path Traversal flaw in mlflow/mlflow before 2.3.1. The connected sources (Nuclei template, OSV entries, GHSA advisories) describe a vulnerability allowing traversal to read sensitive server files (LFI) via a crafted path. Affected software: mlflow/mlflow, versions prio...

Mlflow security vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.3.1. An attacker exploiting this vulnerability could access files and directories stored outside of the web root folder...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability exists due to improper access control in handlers.py which allows an attacker to traverse outside the restricted directory and download arbitrary files on the server. Note that mlflow is only affected if it runs with either mlflow server o...

Path Traversal

mlflow is vulnerable to Path Traversal. The vulnerability exists due to filestore.py because it lacks adequate validation for model names with path separators, which allows an attacker to check if an arbitrary file exists on the server. The vulnerability is only applicable if the mlflow server or...

Local File Read Bypass in mlflow/mlflow

Description This is a bypass to the following submission which was assigned CVE-2023-1177. Proof of Concept Start the server or UI it works on both identically mlflow ui --host 127.0.0.1:5000 1. Create a Model named "AJAX-API". curl -i -s -k -X $'POST' -H $'Host: 127.0.0.1:5000' -H $'User-Agent:...

Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs

Impact Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the mlflow server or mlflow ui commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file existence check exploit if they are not limiting who can query their server for...