PyPI/mlflow CVE-2024-3573: critical 9.3, EPSS 0.73%
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_loc
Action: Upgrade mlflow to 2.10.0 or later.
pip install mlflow==2.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.10.0 | - |
Fixed versions
| 2.10.0 |
Sources
- osv: PYSEC-2024-243
- https://huntr.com/bounties/8ea058a7-4ef8-4baf-9198-bc0147fc543c
- https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc
- https://github.com/advisories/GHSA-hq88-wg7q-gp4g
CVE-2024-3573 · published · modified · JSON