CVE-2024-24591

Advisory

Clearml 1.14.2 fixes potential path traversal on file download.
https://github.com/allegroai/clearml/commit/831c1394da0d99cc65b0fe060a6dfff13816efab

Affected package

Affected versions

Fixed versions

Vulnerability changelog

New Features and Improvements

- Report upload/download with `tqdm` if installed
- Add support for a `PipelineController.version` property
- Add support for specifying an AWS profile when providing bucket storage credentials
- Add an `ignore_remote_overrides` argument to `Task.connect()` and `Task.connect_configuration()` allowing users to disable overriding values when running remotely
- Add support for setting a custom certificate path using the `CLEARML_API_HOST_VERIFY_CERT` environment variable (instead of just allowing the user to disable verification)
- Add dataset reporting example (1180)
- Update README GIFs (1191)

Bug Fixes

- Fix missing component callbacks on multiple step calls (1195, thanks materight!)
- Fix unsafe usage of `tempfile.mktemp`
- Fix potential path traversal on file download (CVE-2024-24591)
- Fix Python 3.12 support by not using `distutils`
- Fix `TaskScheduler` does not save local state before running remotely
- Fix pipeline should continue instead of aborting when `PipelineController.abort_on_failure` is set to False and a step has been aborted
- Fix HPO crashes when its corresponding task is initialized with `continue_last_task=True`

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24591