Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: HiddenLayer
Published: 2024-06-04T12:01:58.728Z
Updated: 2024-06-06T14:56:50.566Z
Reserved: 2024-05-31T14:16:48.807Z
Link: CVE-2024-37059
JSON object: View
NVD Information
Status : Awaiting Analysis
Published: 2024-06-04T12:15:12.227
Modified: 2024-06-04T16:57:41.053
Link: CVE-2024-37059
JSON object: View
Redhat Information
No data.
CWE