Undefined Behavior Affecting mlflow package, versions [,2.11.3)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (15th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-MLFLOW-7217835
- published 7 Jun 2024
- disclosed 6 Jun 2024
- credit dan-xzero
Introduced: 6 Jun 2024
CVE-2024-3099 Open this link in a new tabHow to fix?
Upgrade mlflow to version 2.11.3 or higher.
Overview
mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.
Affected versions of this package are vulnerable to Undefined Behavior due to inadequate validation of model names. An attacker can disrupt service or poison data models by creating multiple entries under the same name, exploiting URL encoding differences.
References
CVSS Scores
version 3.1