GitHub Advisoryadvisory · PyPI

GHSA-qpgc-w4mg-6v92 MLflow's excessive directory permissions allow local privilege escalation

HIGH Published 2024-11-25 Modified 2024-11-25 Official page ↗
Aliases
CVE-2024-27134
Ecosystem
PyPI
Packages
mlflow
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-276
Reviewed
2024-11-25

Affected packages

• PyPI mlflow: < 2.16.0 → fixed in 2.16.0

Description

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.

Related

Alias · CVE (1)

  • CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References