CVE-2024-37057: High severity mlflow vulnerability
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37057?
CVE-2024-37057 is considered a critical vulnerability due to the potential for arbitrary code execution from untrusted data deserialization.
How do I fix CVE-2024-37057?
To fix CVE-2024-37057, upgrade the MLflow platform to a version later than 2.14.1.
What versions of MLflow are affected by CVE-2024-37057?
MLflow versions from 2.0.0rc0 up to and including 2.14.1 are affected by CVE-2024-37057.
What are the consequences of exploiting CVE-2024-37057?
Exploiting CVE-2024-37057 allows a malicious Tensorflow model to execute arbitrary code on the user’s system.
Is CVE-2024-37057 relevant for all MLflow users?
Yes, all users of MLflow versions 2.0.0rc0 to 2.14.1 should be aware of CVE-2024-37057 and take action.