Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: HiddenLayer
Published: 2024-06-04T12:00:51.438Z
Updated: 2024-06-04T19:52:49.951Z
Reserved: 2024-05-31T14:16:48.807Z
Link: CVE-2024-37055
JSON object: View
NVD Information
Status : Awaiting Analysis
Published: 2024-06-04T12:15:11.397
Modified: 2024-06-04T16:57:41.053
Link: CVE-2024-37055
JSON object: View
Redhat Information
No data.
CWE