CVE-2024-3573
2 advisories.
PyPI/mlflow CVE-2024-3573: critical 9.3
mlflow vulnerable to Path Traversal
Action: Upgrade mlflow to 2.10.0 or later.
pip install mlflow==2.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.10.0 | - |
Fixed versions
| 2.10.0 |
Sources
- osv: GHSA-hq88-wg7q-gp4g
- https://nvd.nist.gov/vuln/detail/CVE-2024-3573
- https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc
- https://github.com/mlflow/mlflow
- https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2024-243.yaml
- https://huntr.com/bounties/8ea058a7-4ef8-4baf-9198-bc0147fc543c
CVE-2024-3573 · published · modified · JSON
PyPI/mlflow CVE-2024-3573: critical 9.3
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_loc
Action: Upgrade mlflow to 2.10.0 or later.
pip install mlflow==2.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.10.0 | - |
Fixed versions
| 2.10.0 |
Sources
- osv: PYSEC-2024-243
- https://huntr.com/bounties/8ea058a7-4ef8-4baf-9198-bc0147fc543c
- https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc
- https://github.com/advisories/GHSA-hq88-wg7q-gp4g
CVE-2024-3573 · published · modified · JSON