Homepage

mlrun@1.6.0rc2 vulnerabilities

Tracking and config of machine learning runs

  • latest version

    1.10.0

  • latest non vulnerable version

    1.11.0rc7

  • first published

    6 years ago

  • latest version published

    17 days ago

  • licenses detected

    • MIT
      [0.1.6,1.6.0rc19)
  • View mlrun package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the mlrun package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Deserialization of Untrusted Data

    mlrun is a Tracking and config of machine learning runs

    Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the import_function_to_dict function in the run.py file.

    How to fix Deserialization of Untrusted Data?

    Upgrade mlrun to version 1.10.0rc19 or higher.

    [,1.10.0rc19)
    • M
    Directory Traversal

    mlrun is a Tracking and config of machine learning runs

    Affected versions of this package are vulnerable to Directory Traversal in the _get_log_size_legacy() function in api/crud/logs.py. This allows attackers to access locations on the filesystem outside the project directory.

    How to fix Directory Traversal?

    Upgrade mlrun to version 1.8.0rc30 or higher.

    [,1.8.0rc30)
    • M
    SQL Injection

    mlrun is a Tracking and config of machine learning runs

    Affected versions of this package are vulnerable to SQL Injection in the TDEngineSchema class in the Model Monitoring component, which passes raw user input into SQL queries.

    How to fix SQL Injection?

    Upgrade mlrun to version 1.7.0rc39 or higher.

    [,1.7.0rc39)
    • M
    Race Condition

    mlrun is a Tracking and config of machine learning runs

    Affected versions of this package are vulnerable to Race Condition related to the buffer pool.

    How to fix Race Condition?

    Upgrade mlrun to version 1.7.0rc5 or higher.

    [,1.7.0rc5)
    Go back to all versions of this package