CVE-2024-37054: High severity mlflow vulnerability
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37054?
CVE-2024-37054 is considered a critical vulnerability due to the potential for arbitrary code execution.
How do I fix CVE-2024-37054?
To fix CVE-2024-37054, upgrade the MLflow platform to the latest version beyond 2.14.1.
Which versions of MLflow are affected by CVE-2024-37054?
CVE-2024-37054 affects all MLflow versions from 0.9.0 up to and including 2.14.1.
What type of attack is CVE-2024-37054 associated with?
CVE-2024-37054 is associated with deserialization of untrusted data, allowing malicious PyFunc models to execute arbitrary code.
What should I do if I have deployed a vulnerable version of MLflow related to CVE-2024-37054?
If you have deployed a vulnerable version of MLflow, immediately update to a patched version and review your systems for any suspicious activity.