CRITICAL 10.0

GHSA-5p3h-7fwh-92rc

Remote Code Execution due to Full Controled File Write in mlflow

상세

The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution (like overwriting `/home/<user>/.bashrc`). A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.

이 버전이 영향받나요?

사용 중인 패키지 버전을 입력하면 즉시 평가합니다.

영향 패키지

PyPI / mlflow

최초 영향 버전: 0 수정 버전: 2.9.2

수정 pip install --upgrade 'mlflow>=2.9.2'

참고

https://nvd.nist.gov/vuln/detail/CVE-2023-6018 [ADVISORY]
https://github.com/mlflow/mlflow/commit/55c72d02380e8db8118595a4fdae7879cb7ac5bd [WEB]
https://github.com/mlflow/mlflow [PACKAGE]
https://huntr.com/bounties/7cf918b5-43f4-48c0-a371-4d963ce69b30 [WEB]