MLFlow unsafe deserialization

GHSA-76cg-cfhx-373f · BIT-mlflow-2024-37052 · CVE-2024-37052 · PYSEC-2026-1643 · 갱신 2026. 7. 8.

해야 할 일

아직 수정 버전이 없습니다. 원문의 우회 방법을 확인하고 노출 범위를 줄이세요.

영향 받는 패키지

생태계	패키지	수정 버전
PyPI	mlflow	없음

원문

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.

출처

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-37052
PACKAGEhttps://github.com/mlflow/mlflow
WEBhttps://hiddenlayer.com/sai-security-advisory/mlflow-june2024

오늘 목록으로

MLFlow unsafe deserialization (GHSA-76cg-cfhx-373f) · Sieve