CVE-2024-24762

Advisory

Mlrun version 1.6.2rc1 upgrades its FastAPI dependency to approximately version 0.110.0 from 0.103.2 to mitigate the security risks identified in CVE-2024-24762.
https://github.com/mlrun/mlrun/pull/5205/commits/71647ae50e2f6a97adbad3312c1737db46b7eb38

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Features / Enhancements
* **Linting**: Backport ruff upgrade [1.6.x], 5253, jond01
* **K8s**: Update label verification flow [1.6.x], 5252, liranbg
* **Workflow**: Support remote workflow with source on image [1.6.x], 5251, alonmr
* **Automation**: Pass envs instead of overflowing envvar [1.6.x], 5249, liranbg
* **K8s**: Support email-like usernames [1.6.x], 5247, theSaarco
* **API**: Bump requirements [1.6.x], 5228, liranbg
* **Jupyter**: Bump requirements [1.6.x], 5225, liranbg
* **Security**: Static analysis issues remediation [1.6.x], 5204, liranbg
* **Security**: Remedy vulnerabilities [1.6.x], 5205, liranbg
* **Version**: Bump 1.6.x to 1.6.2, 5218, liranbg
* **MLRun**: Finalizing docs for 1.6.1, 5217, liranbg
* **UI**: [Features & enhancement](https://github.com/mlrun/ui/releases/tag/v1.6.2-rc1#features-and-enhancements)

Bug fixes
* **Model Monitoring**: Fix default http path when ce namespace is not `mlrun`[1.6.x], 5232, Eyal-Danieli
* **UI**: [Bug fixes](https://github.com/mlrun/ui/releases/tag/v1.6.2-rc1#bug-fixes)


Pull requests:
e1db48cb [Linting] Backport Ruff upgrade [1.6.x] (5253)
e45c26b2 [K8s] Update label verification flow [1.6.x] (5252)
0d6d1ddf [Workflow] Support remote workflow with source on image [1.6.x] (5251)
08fed1d6 [Automation] Pass envs instead of overflowing envvar [1.6.x] (5249)
7fb7b85a [K8s] Support email-like usernames [1.6.x] (5247)
bd241331 [Model Monitoring] Fix default HTTP path when CE namespace is not `mlrun`[1.6.x] (5232)
c8b9eb69 [API] Bump requirements [1.6.x] (5228)
a5551bde [Jupyter] Bump requirements [1.6.x] (5225)
e3bf772e [Security] Static analysis issues remediation [1.6.x] (5204)
d80c08be [Security] Remedy vulnerabilities [1.6.x] (5205)
80404fad [Version] Bump 1.6.x to 1.6.2 (5218)
548b5a1f [MLRun] Finalizing docs for 1.6.1 (5217)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24762