PT-2022-13398 · Mlflow · Mlflow
CVE-2022-0736
·
Published
2022-02-23
·
Updated
2024-03-06
CVSS v4.0
8.8
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
mlflow versions prior to 1.23.1
Description
The issue is related to an insecure temporary file in the GitHub repository mlflow/mlflow. The
tempfile.mktemp() function is deprecated and should be replaced with mkstemp().Recommendations
For versions prior to 1.23.1, update to version 1.23.1 or later to resolve the issue. As a temporary workaround, consider replacing the
tempfile.mktemp() function with mkstemp() to minimize the risk of exploitation.Exploit
Fix
DoS
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mlflow