CVE-2024-37061
Fixed in a distro release EPSS <1%CVSS 8.8
Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run.
Products: mlflow, lfprojects mlflow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | mlflow | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | mlflow | 2.13.2-r0 |
| Chainguard | mlflow-bitnami | 2.13.2-r0 |
| Chainguard | mlflow-iamguarded-compat | 2.13.2-r0 |
| Wolfi | mlflow | 2.13.2-r0 |
| Wolfi | mlflow-bitnami | 2.13.2-r0 |
| Wolfi | mlflow-iamguarded-compat | 2.13.2-r0 |