CVE-2024-0520 Remote Code Execution due to Full Controlled File Write in mlflow/mlflow

A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command 'Command Injection' within the mlflow.data.httpdatasetsource.py module. Specifically, when loading a dataset from a source URL with an HTTP...

CVE-2024-3099

CVE-2024-3099 affects mlflow/mlflow 2.11.1 and is caused by inadequate validation of model names, allowing URL-encoded names to be treated as distinct from their decoded counterparts. This enables an attacker to create multiple models with the same name, leading to DoS (an authenticated user may ...

CVE-2024-3099 Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow

A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service DoS as an authenticated user might not be able to use the intended model, as it will open a different model each time...

CVE-2024-3099 Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow

A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service DoS as an authenticated user might not be able to use the intended model, as it will open a different model each time...

Mlflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow that stems from special elements used in operating system commands that are not properly neutralized, which allows an attacker to exploit path traversal or absolute path techniques to enab...

PT-2024-23711

Name of the Vulnerable Software and Affected Versions mlflow/mlflow version 2.11.1 Description A vulnerability in mlflow/mlflow allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service DoS as an authenticated user might not ...

PT-2024-22849 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow/mlflow versions 2.9.2 through 2.11.2 Description: A Local File Inclusion LFI issue was identified, arising from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker c...

Mlflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow that stems from the ability to create multiple models with the same name using URL encoding, potentially leading to a denial of service...

MLflow Security Vulnerabilities

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in MLflow that stems from the discovery of a Local File Inclusion LFI vulnerability...

GHSA-WF7F-8FXF-XFXC vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-CV6C-7963-WXCG vulnerabilities

Vulnerabilities for packages: mlflow...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +164 more potentially affected by CVE-2024-37061 via mlflow (>=1.11.0 <=2.13.1)

mlflow PYPI version =1.11.0, =0.1.0, =0.0.5, =0.1.2, =1.0.72, =0.0.1, =1.0.72.1, =1.4.0, =0.2.5, =0.1.3, =3.0.0, =0.1.0, =0.3.5, =0.8.0, =1.0.0 and more Source cves: CVE-2024-37061 Source advisory: OSV:GHSA-PQCV-QW2R-R859...

autorad (=0.2.6), bernn (>=0.1.3 <=0.3.2) +31 more potentially affected by CVE-2024-37057 via mlflow (>=2.0.0rc0 <=2.14.1)

mlflow PYPI version =2.0.0rc0, =0.1.3, =1.2.0, =0.8.0, =0.0.10, =1.0.0, =0.0.1, =0.1.0, =1.10.2, =0.1.2, =1.2.7, =1.6.1, =0.2.9, =0.3.0 - llm-foundry =0.9.0 and more Source cves: CVE-2024-37057 Source advisory: OSV:GHSA-J8MG-PQC5-X9GJ...

a2 (>=0.1.0 <=0.3.17), agentos (>=0.0.5 <=0.0.7) +112 more potentially affected by CVE-2024-37060 via mlflow (>=1.27.0 <=2.14.1)

mlflow PYPI version =1.27.0, =0.1.0, =0.0.5, =1.0.72, =0.0.1, =1.0.72.1, =0.2.5, =0.1.3, =0.1.0, =0.3.5, =0.8.0, =1.2.0, =1.9.30 - cortic =0.1.0 and more Source cves: CVE-2024-37060 Source advisory: OSV:GHSA-CV6C-7963-WXCG...

a2 (>=0.1.0 <=0.3.17), abadpour (>=6.13.1 <=7.24.1) +946 more potentially affected by CVE-2024-37059 via mlflow (>=0.8.2 <=3.4.0)

mlflow PYPI version =0.8.2, =0.1.0, =6.13.1, =9.273.1, =1.1.0, =0.1.0, =0.1.0, =0.4.4, =0.3.0, =0.0.5, =1.0.0, =0.1.0, =1.1.1 - ai-helpers-pytorch-utils =0.1.0a1 - ailine-core =0.5.5 and more Source cves: CVE-2024-37059 Source advisory: OSV:GHSA-WF7F-8FXF-XFXC...

GHSA-J8MG-PQC5-X9GJ vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-CWGG-W6MP-W9HG vulnerabilities

Vulnerabilities for packages: mlflow...

GHSA-WF7F-8FXF-XFXC MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run...

MLFlow improper input validation

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run due to unfiltered input...