Abhisheku/mmlab model selection

[abhishekMS2024]

Update import_model component to support MMLab models.

Sample run:

[vizhur]

Those conda specs can't be a part of any AzureML asset

[vizhur]

"vulnerabilities": [
    {
        "aliases": [
            "CVE-2024-37057"
        ],
        "details": "Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.",
        "fixed_in": [],
        "id": "GHSA-j8mg-pqc5-x9gj",
        "link": "https://osv.dev/vulnerability/GHSA-j8mg-pqc5-x9gj",
        "source": "osv",
        "summary": null,
        "withdrawn": null
    },
    {
        "aliases": [
            "CVE-2024-37052"
        ],
        "details": "Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.",
        "fixed_in": [],
        "id": "GHSA-76cg-cfhx-373f",
        "link": "https://osv.dev/vulnerability/GHSA-76cg-cfhx-373f",
        "source": "osv",
        "summary": null,
        "withdrawn": null
    },
    {
        "aliases": [
            "CVE-2024-37053"
        ],
        "details": "Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.",
        "fixed_in": [],
        "id": "GHSA-43c4-9qgj-x742",
        "link": "https://osv.dev/vulnerability/GHSA-43c4-9qgj-x742",
        "source": "osv",
        "summary": null,
        "withdrawn": null
    },
    {
        "aliases": [
            "CVE-2024-37056"
        ],
        "details": "Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with.",
        "fixed_in": [],
        "id": "GHSA-7p8j-qv6x-f4g4",
        "link": "https://osv.dev/vulnerability/GHSA-7p8j-qv6x-f4g4",
        "source": "osv",
        "summary": null,
        "withdrawn": null
    },
    {
        "aliases": [
            "CVE-2024-37060"
        ],
        "details": "Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.",
        "fixed_in": [],
        "id": "GHSA-cv6c-7963-wxcg",
        "link": "https://osv.dev/vulnerability/GHSA-cv6c-7963-wxcg",
        "source": "osv",
        "summary": null,
        "withdrawn": null
    },
    {
        "aliases": [
            "CVE-2024-37055"
        ],
        "details": "Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with.",
        "fixed_in": [],
        "id": "GHSA-x38x-g6gr-jqff",
        "link": "https://osv.dev/vulnerability/GHSA-x38x-g6gr-jqff",
        "source": "osv",
        "summary": null,
        "withdrawn": null
    },
    {
        "aliases": [
            "CVE-2024-37054"
        ],
        "details": "Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.",
        "fixed_in": [],
        "id": "GHSA-ghv6-9r9j-wh4j",
        "link": "https://osv.dev/vulnerability/GHSA-ghv6-9r9j-wh4j",
        "source": "osv",
        "summary": null,
        "withdrawn": null
    },
    {
        "aliases": [
            "CVE-2024-37058"
        ],
        "details": "Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with.",
        "fixed_in": [],
        "id": "GHSA-cwgg-w6mp-w9hg",
        "link": "https://osv.dev/vulnerability/GHSA-cwgg-w6mp-w9hg",
        "source": "osv",
        "summary": null,
        "withdrawn": null
    },
    {
        "aliases": [
            "CVE-2024-37061"
        ],
        "details": "Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run due to unfiltered input.",
        "fixed_in": [],
        "id": "GHSA-pqcv-qw2r-r859",
        "link": "https://osv.dev/vulnerability/GHSA-pqcv-qw2r-r859",
        "source": "osv",
        "summary": null,
        "withdrawn": null
    },
    {
        "aliases": [
            "CVE-2024-37059"
        ],
        "details": "Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with.",
        "fixed_in": [],
        "id": "GHSA-wf7f-8fxf-xfxc",
        "link": "https://osv.dev/vulnerability/GHSA-wf7f-8fxf-xfxc",
        "source": "osv",
        "summary": null,
        "withdrawn": null
    },
    {
        "aliases": [
            "CVE-2024-27134"
        ],
        "details": "Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.",
        "fixed_in": [
            "2.16.0"
        ],
        "id": "GHSA-qpgc-w4mg-6v92",
        "link": "https://osv.dev/vulnerability/GHSA-qpgc-w4mg-6v92",
        "source": "osv",
        "summary": null,
        "withdrawn": null
    }
]

}

[vizhur]

below is the list of vulnerabilities just for the first package https://pypi.org/pypi/mlflow/2.12.1/json