REDHAT-BUG-2452949: Command Injection
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the installmodeldependenciestoenv() function. When deploying a model with envmanager=LOCAL, MLflow reads dependency specifications from the model artifact's pythonenv.yaml file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mlflowto a version that resolves this vulnerability.Fixed in 3.8.2 - Configuration
For MLflow model deployments, avoid using env_manager=LOCAL to prevent MLflow from reading python_env.yaml dependency specifications from the model artifact and interpolating them into an unsanitized shell command.
MLflow model serving (env_manager=LOCAL) env_manager = not LOCAL
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2452949?
The severity of REDHAT-BUG-2452949 is high with a rating of 7.
What is the nature of the vulnerability in REDHAT-BUG-2452949?
REDHAT-BUG-2452949 is a command injection vulnerability found in MLflow's model serving container initialization code.
How do I fix REDHAT-BUG-2452949?
To fix REDHAT-BUG-2452949, update MLflow to the latest version where this vulnerability has been addressed.
What components are affected by REDHAT-BUG-2452949?
The affected component in REDHAT-BUG-2452949 is the `_install_model_dependencies_to_env()` function within MLflow.
What type of attack does REDHAT-BUG-2452949 enable?
REDHAT-BUG-2452949 enables a command injection attack when deploying a model with `env_manager=LOCAL`.