Allegro AI ClearML vulnerable to deserialization of untrusted data

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2024-24590 · ADVISORY
• allegroai/clearml · PACKAGE
• hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain · WEB
• hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain · Exploit
• pypi.org/project/clearml · PACKAGE
• GitHub Advisory GHSA-cpcw-9h9m-wqw9 · ADVISORY
• clearml/clearml commit e506831 · FIX

Lỗ hổng khác của clearml

• CVE-2025-8917TRUNG BÌNH 5.8A vulnerability in allegroai/clearml version v2.0.1 allows for path traversal due to improper handling of symbolic and hard links in the `sa…
• CVE-2024-24591CAO 8.8A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded…
• CVE-2024-24595CAO 7.1Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server lea…