REDHAT-BUG-2452341: High severity mlflow/mlflow vulnerability
In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments. Deployments using mlflow server --app-name=basic-auth are affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2452341?
The severity of REDHAT-BUG-2452341 is classified as high (7).
How do I fix REDHAT-BUG-2452341?
To fix REDHAT-BUG-2452341, ensure that permission validators are implemented for the tracing and assessment endpoints when using the basic-auth app.
What systems are affected by REDHAT-BUG-2452341?
REDHAT-BUG-2452341 affects the mlflow/mlflow software, specifically when the basic-auth app is enabled.
What are the risks associated with REDHAT-BUG-2452341?
The risks associated with REDHAT-BUG-2452341 include unauthorized access to trace information and the ability to create assessments by users with no permissions.
What is the description of REDHAT-BUG-2452341?
REDHAT-BUG-2452341 describes a vulnerability where tracing and assessment endpoints are not protected, allowing any authenticated user to read sensitive information.