a2 (>=0.1.0, <=0.3.17), ikomia (>=0.9.0, <=0.13.0) +2 more potentially affected by CVE-2023-1177 via mlflow (1.30.0)

mlflow PYPI version 1.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - a2 =0.1.0, =0.9.0, =0.13.0 - mantik 0.1.2 - pyrovelocity 0.1.1 Source cves: CVE-2023-1177 Source advisory: OSV:PYSEC-2023-29...

dagster-mlflow (>=0.14.18rc5, <=0.17.21), sparkpipelineframework (1.0.18) potentially affected by CVE-2023-1177 via mlflow (1.26.0)

mlflow PYPI version 1.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.14.18rc5, =0.17.21 - sparkpipelineframework 1.0.18 Source cves: CVE-2023-1177 Source advisory: OSV:PYSEC-2023-29...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2023-1177 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2023-1177 Source advisory: OSV:PYSEC-2023-29...

autorad (>=0.2.2, <=0.2.5), katonic (>=1.3.0, <=1.6.0) potentially affected by CVE-2023-1176 via mlflow (1.23.1)

mlflow PYPI version 1.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad =0.2.2, =1.3.0, =1.6.0 Source cves: CVE-2023-1176 Source advisory: OSV:PYSEC-2023-28...

mlflow-asus-aimaker (>=0.0.6, <=1.0.2), newsmodel (0.1.0) +3 more potentially affected by CVE-2023-1176 via mlflow (1.24.0)

mlflow PYPI version 1.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-asus-aimaker =0.0.6, =1.3.0, =3.1.1, =3.1.4, =3.1.6 Source cves: CVE-2023-1176 Source advisory: OSV:PYSEC-2023-28...

autorad (0.1.2), merlin-sdk (>=0.19.0rc1, <=0.34.1) +2 more potentially affected by CVE-2023-1176 via mlflow (1.23.0)

mlflow PYPI version 1.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autorad 0.1.2 - merlin-sdk =0.19.0rc1, =0.7.2rc1, =0.12.0 Source cves: CVE-2023-1176 Source advisory: OSV:PYSEC-2023-28...

PYSEC-2023-28

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

Path traversal

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

mlfields (0.0.0), poms (0.0.0) potentially affected by CVE-2023-1176 via mlflow (1.20.1)

mlflow PYPI version 1.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlfields 0.0.0 - poms 0.0.0 Source cves: CVE-2023-1176 Source advisory: OSV:PYSEC-2023-28...

insurautoml (>=0.2.2.10, <=0.2.3), ntcore (>=0.0.1, <=0.0.3) +2 more potentially affected by CVE-2023-1176 via mlflow (1.21.0)

mlflow PYPI version 1.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - insurautoml =0.2.2.10, =0.0.1, =3.0.0, =2.6.3, =2.6.4 Source cves: CVE-2023-1176 Source advisory: OSV:PYSEC-2023-28...

CVE-2023-1176 Absolute Path Traversal in mlflow/mlflow

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

CVE-2023-1176 Absolute Path Traversal in mlflow/mlflow

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

PT-2023-16800 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow versions prior to 2.2.2 Description: The issue is related to an Absolute Path Traversal in the GitHub repository mlflow/mlflow. Recommendations: For versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue...

CVE-2023-1176

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

Mlflow security vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.2.2 that stems from the presence of an absolute path traversal vulnerability...

CVE-2023-1176 Absolute Path Traversal in mlflow/mlflow

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

CVE-2023-1176: Absolute Path Traversal

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

CVE-2023-1177

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

CVE-2023-1177 Path Traversal: '\..\filename' in mlflow/mlflow

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1...

Mlflow path traversal vulnerability

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow versions prior to 2.2.1 that stems from the presence of a path traversal vulnerability...