PT-2022-13398 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow versions prior to 1.23.1 Description: The issue is related to an insecure temporary file in the GitHub repository mlflow/mlflow. The tempfile.mktemp function is deprecated and should be replaced with mkstemp. Recommendations: For...

Mlflow 安全漏洞

Mlflow is an open source platform for machine learning lifecycles. A security vulnerability exists in Mlflow that stems from the product's tempfile.mktemp function failing to properly handle multi-process state. The vulnerability allows an attacker to create a temporary file with the same name. T...

Insecure Temporary File in mlflow/mlflow

Description mlflow package is using the deprecated function tempfile.mktemp which is not secure. Because a different process may create a file with this name in the time between the call to mktemp and the subsequent attempt to create the file by the first process. Impact Availability will get...