[BUG] Security Vulnerability

[JoeBeeton]

Issues Policy acknowledgement

• I have read and agree to submit bug reports in accordance with the issues policy

Willingness to contribute

No. I cannot contribute a bug fix at this time.

MLflow version

mlflow, version 2.6.0

System information

Ubuntu 22.04.2
Python 3.10.12

Describe the problem

Security Vulnerability

Tracking information

REPLACE_ME

Code to reproduce issue

Security Vulnerability

Stack trace

REPLACE_ME

Other info / logs

REPLACE_ME

What component(s) does this bug affect?

• area/artifacts: Artifact stores and artifact logging
• area/build: Build and test infrastructure for MLflow
• area/docs: MLflow documentation pages
• area/examples: Example code
• area/gateway: AI Gateway service, Gateway client APIs, third-party Gateway integrations
• area/model-registry: Model Registry service, APIs, and the fluent client calls for Model Registry
• area/models: MLmodel format, model serialization/deserialization, flavors
• area/recipes: Recipes, Recipe APIs, Recipe configs, Recipe Templates
• area/projects: MLproject format, project running backends
• area/scoring: MLflow Model server, model deployment tools, Spark UDFs
• area/server-infra: MLflow Tracking server backend
• area/tracking: Tracking Service, tracking client APIs, autologging

What interface(s) does this bug affect?

• area/uiux: Front-end, user experience, plotting, JavaScript, JavaScript dev server
• area/docker: Docker use across MLflow's components, such as MLflow Projects and MLflow Models
• area/sqlalchemy: Use of SQLAlchemy in the Tracking Service or Model Registry
• area/windows: Windows support

What language(s) does this bug affect?

• language/r: R APIs and clients
• language/java: Java APIs and clients
• language/new: Proposals for new client languages

What integration(s) does this bug affect?

• integrations/azure: Azure and Azure ML integrations
• integrations/sagemaker: SageMaker integrations
• integrations/databricks: Databricks integrations

[BenWilson2]

Hi @JoeBeeton thank you for reporting this!
We are currently looking into it and will test some ideas for preventing the reported issue.

[JoeBeeton]

Hi, no problem. Let me know if you need anything else.

Joe

[github-actions]

@mlflow/mlflow-team Please assign a maintainer and start triaging this issue.

[JoeBeeton]

Hi

Any news on this? I've tried to contact the email address provided but with no response after the initial message.
Joe

[JoeBeeton]

Hi

@BenWilson2 any news?

[JoeBeeton]

Hi, whoever on the mlflow side has access, please check mlflow-oss-maintainers@googlegroups.com

[B-Step62]

@JoeBeeton Thank you so much for reporting the vulnerability and terribly sorry for not being responsive. We are working on the fix right now.

[JoeBeeton]

Thanks, FYI, the cve is CVE-2023-43472 . Do you know when the fix will be released?

[B-Step62]

It will be released in next release this week.

[JoeBeeContrast]

Thanks