dagster-mlflow (>=0.19.11, <=0.21.4), databricks-session (0.1.9) +14 more potentially affected by CVE-2025-0453 via mlflow (1.27.0)

mlflow PYPI version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.19.11, =0.3.0, =0.0.4.dev3, =3.0.1, =4.0.2, =0.1.0, =3.2.18, =0.1.0, =0.0.1.dev202206240024, =0.1.0, =0.1.5 and more Source cves:...

dagster-mlflow (>=0.19.11, <=0.21.4), databricks-session (0.1.9) +14 more potentially affected by CVE-2024-8859 via mlflow (1.27.0)

mlflow PYPI version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.19.11, =0.3.0, =0.0.4.dev3, =3.0.1, =4.0.2, =0.1.0, =3.2.18, =0.1.0, =0.0.1.dev202206240024, =0.1.0, =0.1.5 and more Source cves:...

Relative Path Traversal

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Relative Path Traversal in the...

Privilege escalation from writing file into temporary directory to arbitrary code execution

Description The MLFlow temporary directory gets assigned insecure world-writable permissions 0o777. def getorcreatetmpdir: """ Get or create a temporary directory which will be removed once python process exit. """ from mlflow.utils.databricksutils import getreplid, isindatabricksruntime if...

Databricks JDBC Driver Code Execution

The vulnerability of Databricks JDBC driver is related to the lack of measures taken at the control level to clean data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Remote Code Execution (RCE)

com.databricks, databricks-jdbc is vulnerable to Remote code execution RCE. The vulnerability is due to insufficient validation or sanitization of the krbJAASFile parameter in the Databricks JDBC Driver, allows the attacker to manipulate the JDBC URL, enabling a JNDI injection that can lead to...

io.kestra.plugin:plugin-databricks (>=0.11.0, <=0.17.0), org.finos.legend-community:legend-delta (>=0.1.5, <=0.1.10) +92 more potentially affected by CVE-2024-49194 via com.databricks:databricks-jdbc (>=2.6.25, <=2.6.38)

com.databricks:databricks-jdbc MAVEN version =2.6.25, =0.11.0, =0.1.5, =0.0.8, =0.1.1, =release-4.96.3, =release-4.96.3, =release-4.96.3, =release-4.96.3, =4.7.1, =release-4.96.3, =release-4.96.3, =release-4.96.3, =4.129.1 -...

io.kestra.plugin:plugin-databricks (>=0.11.0, <=0.17.0), org.finos.legend-community:legend-delta (>=0.1.5, <=0.1.10) +92 more potentially affected by CVE-2024-49194 via com.databricks:databricks-jdbc (>=2.6.25, <=2.6.38)

com.databricks:databricks-jdbc MAVEN version =2.6.25, =0.11.0, =0.1.5, =0.0.8, =0.1.1, =release-4.96.3, =release-4.96.3, =release-4.96.3, =release-4.96.3, =4.7.1, =release-4.96.3, =release-4.96.3, =release-4.96.3, =4.129.1 -...

Databricks JDBC Driver Command Injection vulnerability

Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution RCE by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achiev...

CVE-2024-49194

Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution RCE by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achiev...

CVE-2024-49194

The Databricks JDBC Driver 2.x (prior to version 2.6.40 ) is vulnerable to Remote Code Execution (RCE) due to a JNDI injection flaw. The root cause is the improper handling of the krbJAASFile parameter within the JDBC URL. An attacker can exploit this by tricking a victim into using a crafted con...

CVE-2024-49194: Improper Neutralization of Special Elements used in a Command

Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution RCE by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achiev...

Databricks JDBC Driver security vulnerabilities

Databricks JDBC Driver is a driver from Databricks, Inc. A security vulnerability exists in Databricks JDBC Driver versions prior to 2.6.40 that stems from improper handling of the krbJAASFile parameter. An attacker can exploit the vulnerability to remotely execute code...

io.kestra.plugin:plugin-databricks (>=0.11.0, <=0.17.0), org.finos.legend-community:legend-delta (>=0.1.5, <=0.1.10) +92 more potentially affected by CVE-2024-49194 via com.databricks:databricks-jdbc (>=2.6.25, <=2.6.38)

com.databricks:databricks-jdbc MAVEN version =2.6.25, =0.11.0, =0.1.5, =0.0.8, =0.1.1, =release-4.96.3, =release-4.96.3, =release-4.96.3, =release-4.96.3, =4.7.1, =release-4.96.3, =release-4.96.3, =release-4.96.3, =4.129.1 -...

CVE-2024-49194

Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution RCE by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achiev...

CVE-2024-49194

Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution RCE by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achiev...

CVE-2024-49194

Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution RCE by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achiev...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2024-45784 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2024-45784 Source advisory: OSV:PYSEC-2024-182...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2024-50378 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2024-50378 Source advisory: OSV:GHSA-J857-2PWM-JJMM...

PT-2024-10170 · Databricks · Databricks Jdbc Driver

Name of the Vulnerable Software and Affected Versions: Databricks JDBC Driver versions prior to 2.6.40 Description: The issue is related to the improper handling of the krbJAASFile parameter, allowing a remote attacker to execute arbitrary code by triggering a JNDI injection via a JDBC URL...