Insecure Temporary File Affecting mlflow package, versions [,1.23.1)
Threat Intelligence
EPSS
0.12% (47th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-MLFLOW-2411010
- published 23 Feb 2022
- disclosed 23 Feb 2022
- credit Srikanth Prathi
Introduced: 23 Feb 2022
CVE-2022-0736 Open this link in a new tabHow to fix?
Upgrade mlflow to version 1.23.1 or higher.
Overview
mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.
Affected versions of this package are vulnerable to Insecure Temporary File which is using the deprecated function tempfile.mktemp() that is not secure because a different process may create a file with this name in the time between the call to mktemp() and the attempt to create the file.
References
CVSS Scores
version 3.1