PYSEC-2023-28
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2023-1176
- Alias
- BIT-mlflow-2023-1176, GHSA-wp72-7hj9-5265
Description
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · mlflow | introduced 0, fixed 63ef72aa4334a6473ce7f889573c92fcae0b3c0d ; introduced 0, fixed 2.2.2 |
Références
- https://huntr.dev/bounties/ae92f814-6a08-435c-8445-eec0ef4f1085 EVIDENCE
- https://huntr.dev/bounties/ae92f814-6a08-435c-8445-eec0ef4f1085 FIX
- https://github.com/mlflow/mlflow/commit/63ef72aa4334a6473ce7f889573c92fcae0b3c0d FIX
- https://github.com/advisories/GHSA-wp72-7hj9-5265 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |