Allegro AI ClearML vulnerable to deserialization of untrusted data

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-24590 · ADVISORY
• allegroai/clearml · PACKAGE
• hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain · WEB
• hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain · Exploit
• pypi.org/project/clearml · PACKAGE
• GitHub Advisory GHSA-cpcw-9h9m-wqw9 · ADVISORY
• clearml/clearml commit e506831 · FIX

clearml のその他の脆弱性

• CVE-2025-8917中 5.8A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `sa…
• CVE-2024-24591高 8.8A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded…
• CVE-2024-24595高 7.1Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server lea…