a2 (>=0.1.0, <=0.3.17), auf (>=1.0.0, <=2.0.1) +149 more potentially affected by CVE-2024-37055 via mlflow (>=1.24.0, <=2.14.1)

mlflow PYPI version =1.24.0, =0.1.0, =1.0.0, =1.0.1, =0.1.0, =0.0.1, =0.1.3, =0.1.2, =0.3.5, =0.8.0, =1.2.0, =0.8.0, =0.14.18rc5, =0.21.4 and more Source cves: CVE-2024-37055 Source advisory: GHSA-X38X-G6GR-JQFF...

CVE-2024-37055

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37055 vulnerabilities

Vulnerabilities for packages: mlflow...

CVE-2024-37055

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37055

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with...

CVE-2024-37055

CVE-2024-37055 involves the MLflow platform (v1.24.0+). The issue is a deserialization of untrusted data in the pmdarima model handling, specifically in the _load_model path of mlflow's pmdarima/init .py, which can allow code execution on an end user’s system when a malicious PyFunc model is inte...