CVE-2024-6838: Uncontrolled Resource Consumption in mlflow/mlflow
In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of service. Additionally, there is no character limit in the artifactlocation parameter while creating the experiment.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6838?
CVE-2024-6838 is considered a moderate severity vulnerability due to its potential to cause unresponsiveness in the MLflow UI.
How do I fix CVE-2024-6838?
To fix CVE-2024-6838, implement a limit on the number of integers allowed in experiment names in MLflow version 2.13.2 or earlier.
Which versions are affected by CVE-2024-6838?
CVE-2024-6838 affects MLflow version 2.13.2 and earlier.
What type of vulnerability is CVE-2024-6838?
CVE-2024-6838 is a design flaw that allows for the creation or renaming of experiments without a limit on the name length.
What impact does CVE-2024-6838 have on users?
The impact of CVE-2024-6838 is that it can cause the MLflow UI to become unresponsive when specific conditions are met.