REDHAT-BUG-2452925: Path Traversal
A path traversal vulnerability exists in the extractarchivetodir function within the mlflow/pyfunc/dbconnectartifactcache.py file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox directory in multi-tenant or shared cluster environments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mlflow/mlflowto a version that resolves this vulnerability.Fixed in v3.7.0 - Configuration
Ensure tar member paths are validated/rejected during extraction in extract_archive_to_dir so archive entries cannot escape the sandbox directory (path traversal mitigation).
mlflow/pyfunc/dbconnect_artifact_cache.py (extract_archive_to_dir) Tar member path validation during extraction = enabled
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2452925?
The severity of REDHAT-BUG-2452925 is classified as high, rated 7.
What is the risk associated with REDHAT-BUG-2452925?
The risk associated with REDHAT-BUG-2452925 is rated at 33.
How do I fix REDHAT-BUG-2452925?
To fix REDHAT-BUG-2452925, upgrade to MLflow version 3.7.0 or later.
What type of vulnerability is REDHAT-BUG-2452925?
REDHAT-BUG-2452925 is a path traversal vulnerability.
Which component is affected by REDHAT-BUG-2452925?
The vulnerability exists in the 'extract_archive_to_dir' function of the mlflow/pyfunc/dbconnect_artifact_cache.py file.