CVE-2024-37056
Fixed in a distro release EPSS <1%CVSS 8.8
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with.
Products: mlflow, lfprojects mlflow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | mlflow | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | mlflow | 2.13.2-r0 |
| Chainguard | mlflow | 3.5.1-r1 |
| Chainguard | mlflow-bitnami | 2.13.2-r0 |
| Chainguard | mlflow-iamguarded-compat | 3.5.1-r1 |
| Wolfi | mlflow | 2.13.2-r0 |
| Wolfi | mlflow | 3.5.1-r1 |
| Wolfi | mlflow-bitnami | 2.13.2-r0 |
| Wolfi | mlflow-iamguarded-compat | 3.5.1-r1 |