CVE-2024-3099
published 2024-06-06CVE-2024-3099: A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to…
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUINSUCNILAL
EPSS
0.44%
35.3th percentile
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mlflow | mlflow_mlflow | >= 0 < 2.11.3 | 2.11.3 |
| mlflow | mlflow_mlflow | unspecified – latest | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Undefined Behavior in mlflow
ghsa·2024-06-06
CVE-2024-3099 [MEDIUM] CWE-475 Undefined Behavior in mlflow
Undefined Behavior in mlflow
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts.
OSV
Undefined Behavior in mlflow
osv·2024-06-06
CVE-2024-3099 [MEDIUM] Undefined Behavior in mlflow
Undefined Behavior in mlflow
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2024-39929 exim: exim: Incorrect parsing of multiline rfc2231 header filename
bugzilla·2024-07-04·CVSS 5.4
CVE-2024-39929 [MEDIUM] CVE-2024-39929 exim: exim: Incorrect parsing of multiline rfc2231 header filename
CVE-2024-39929 exim: exim: Incorrect parsing of multiline rfc2231 header filename
Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.
Discussion:
This was fixed in Exim 4.98 per changelog https://code.exim.org/exim/exim/src/branch/master/doc/doc-txt/ChangeLog (reference 3099) and as such should be fixed in all current Fedora versions.
Bugzilla
CVE-2022-48703 kernel: thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR
bugzilla·2024-05-03·CVSS 5.5
CVE-2022-48703 [MEDIUM] CVE-2022-48703 kernel: thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR
CVE-2022-48703 kernel: thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR
In the Linux kernel, the following vulnerability has been resolved:
thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR
The Linux kernel CVE team has assigned CVE-2022-48703 to this issue.
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024050351-CVE-2022-48703-3099@gregkh/T
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2024:9315 https://access.redhat.com/errata/RHSA-2024:9315
2024-06-06
Published