THREAT OPS › Threat News › [GHSA] GHSA-gqvg-gmmx-x4hm (high) — MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
[GHSA] GHSA-gqvg-gmmx-x4hm (high) — MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
GHSA-gqvg-gmmx-x4hm Severity: high CVE: None
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
## Summary
MLflow introduced `MLFLOW_ALLOW_PICKLE_DESERIALIZATION` as a security control to prevent unsafe `pickle.load` execution during model loading, in response to CVE-2024-37052 through CVE-2024-37060. When set to `Fals
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- 0b0c576c642b5b0d9496c829809c7d097403bc9fsha1
- CVE-2024-37052cve
- CVE-2024-37060cve
Original source: https://github.com/advisories/GHSA-gqvg-gmmx-x4hm