PYSEC-2023-29
At a glance
- Published
- Updated
- CVE
- CVE-2023-1177
- Aliases
- BIT-mlflow-2023-1177, GHSA-xg73-94fp-g449
Description
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
Affected packages
| Package | Versions |
|---|---|
| PyPI · mlflow | introduced 0, fixed 7162a50c654792c21f3e4a160eb1a0e6a34f6e6e ; introduced 0, fixed 2.2.1 |
References
- https://huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28 EVIDENCE
- https://huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28 FIX
- https://huntr.dev/bounties/1fe8f21a-c438-4cba-9add-e8a5dab94e28 WEB
- https://github.com/mlflow/mlflow/commit/7162a50c654792c21f3e4a160eb1a0e6a34f6e6e FIX
- https://github.com/advisories/GHSA-xg73-94fp-g449 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |