Insecure Temporary File in mlflow/mlflow

Valid

Reported on

Jan 8th 2022

Description

mlflow package is using the deprecated function tempfile.mktemp() which is not secure. Because a different process may create a file with this name in the time between the call to mktemp() and the subsequent attempt to create the file by the first process.

Impact

Availability will get affected because of this vulnerability.

Remediation

Use mkstemp() instead of tempfile.mktemp()

We are processing your report and will contact the mlflow team within 24 hours. 5 months ago
We created a GitHub Issue asking the maintainers to create a SECURITY.md 4 months ago
Corey Zumar validated this vulnerability 3 months ago
Srikanth Prathi has been awarded the disclosure bounty
The fix bounty is now up for grabs
Corey Zumar confirmed that a fix has been merged on 61984e 3 months ago
The fix bounty has been dropped
file_utils.py#L290 has been validated
to join this conversation