Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-0736

CVE-2022-0736: Insecure Temporary File in mlflow

8.2

CVSS Score
3.0

Basic Information

CVE ID
CVE-2022-0736
GHSA ID
GHSA-vqj2-4v8m-8vrq
EPSS Score
0.68489%
CWE
CWE-377
Published
2/24/2022
Updated
9/30/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
mlflowpip< 1.23.11.23.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The patch for CVE-2022-0736 modified the code in mlflow/utils/file_utils.py to replace tempfile.mktemp() with tempfile.mkstemp(), indicating the function containing this code is vulnerable. Although the exact function name isn't directly provided in the patch snippet, it's related to handling temporary files.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

ml*low prior to *.**.* *ont*ins *n ins**ur* t*mpor*ry *il*. T** ins**ur* *un*tion `t*mp*il*.mkt*mp()` is **pr***t** *n* `mkst*mp()` s*oul* ** us** inst***.

Reasoning

T** p*t** *or *V*-****-**** mo*i*i** t** *o** in ml*low/utils/*il*_utils.py to r*pl*** t*mp*il*.mkt*mp() wit* t*mp*il*.mkst*mp(), in*i**tin* t** *un*tion *ont*inin* t*is *o** is vuln*r**l*. *lt*ou** t** *x**t *un*tion n*m* isn't *ir**tly provi*** in