CVE-2024-2260 (Markdown, published 2024-04-16T00:15Z)
Description: value: A session fixation vulnerability exists in the zenml-io/zenml application, where JWT tokens used for user authentication are not invalidated upon logout. This flaw allows an attacker to bypass authentication mechanisms by reusing a victim's JWT token.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/zenml-io/zenml
Files changed:
README.md
RELEASE_NOTES.md
pyproject.toml
src/zenml/VERSION
src/zenml/zen_server/deploy/helm/Chart.yaml
src/zenml/zen_server/deploy/helm/README.md
src/zenml/zen_stores/migrations/versions/0.56.2_release.py
Commit message: Prepare release 0.56.2 (#2564)

* git commit -m 'Prepare release 0.56.2'

* Fix migration issues and introduce new features

Vulnerable code:
    🎉 Version 0.56.1 is out. Check out the release notes
# 0.56.1
This is a patch release aiming to solve a dependency problem which was brought in with the new rate 
limiting functionality. With 0.56.1 you no longer need `starlette` to run client code or to 
run ZenML CLI commands.
## 🥳 Community Contributions 🥳

We'd like to thank @christianversloot for his contribution to this release.

## What's Changed
* Fix pipelines and model links for the cloud dashboard by @wjayesh in https://github.com/zenml-io/zenml/pull/2554
* Make starlette non-must for client by @avishniakov in https://github.com/zenml-io/zenml/pull/2553
* Bump MLFlow to version 2.11.2 by @christianversloot in https://github.com/zenml-io/zenml/pull/2552


**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.56.0...0.56.1

# 0.56.0

ZenML 0.56.0 introduces a wide array of new features, enhancements, and bug fixes,
with a strong emphasis on elevating the user experience and streamlining machine
## All changes:

**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.55.5...0.56.0
version = "0.56.1"
0.56.1
version: "0.56.1"
# example command for version 0.56.1
helm install my-zenml oci://public.ecr.aws/zenml/zenml --version 0.56.1

Fixed code:
    🎉 Version 0.56.2 is out. Check out the release notes
# 0.56.2
This release replaces 0.56.0 and 0.56.1, and fixes the major migration bugs that were in
that yanked release. Please upgrade directly to 0.56.2 and avoid upgrading to  
0.56.0 to avoid unexpected migration issues.
Note that 0.56.0 and 0.56.1 were removed from PyPI due to an issue with the
alembic versions + migration which could affect the database state. This release
fixes that issue.
This release introduces introduces a wide array of new features, enhancements, and bug fixes, with a strong emphasis on elevating the user experience and streamlining machine
## What's Changed
* Prepare release 0.56.0 by @safoinme in https://github.com/zenml-io/zenml/pull/2546
* Fix formatting and release workflow by @strickvl in https://github.com/zenml-io/zenml/pull/2549
* Fix release workflow by @strickvl in https://github.com/zenml-io/zenml/pull/2550
* Fix pipelines and model links for the cloud dashboard by @wjayesh in https://github.com/zenml-io/zenml/pull/2554
* Make starlette non-must for client by @avishniakov in https://github.com/zenml-io/zenml/pull/2553
* Bump MLFlow to version 2.11.2 by @christianversloot in https://github.com/zenml-io/zenml/pull/2552
* Prepare release 0.56.1 by @avishniakov in https://github.com/zenml-io/zenml/pull/2555
* Updated neptune documentation by @SiddhantSadangi in https://github.com/zenml-io/zenml/pull/2548
* 0.56.0 and 0.56.1 in testing by @avishniakov in https://github.com/zenml-io/zenml/pull/2557
* Only install uv once by @schustmi in https://github.com/zenml-io/zenml/pull/2558
* Bump MLFlow to version 2.11.3 by @christianversloot in https://github.com/zenml-io/zenml/pull/2559
* Update docs with warning about pickle materializer insecurity by @avishniakov in https://github.com/zenml-io/zenml/pull/2561
* Add service table migration by @safoinme in https://github.com/zenml-io/zenml/pull/2563
* @SiddhantSadangi made their first contribution in https://github.com/zenml-io/zenml/pull/2548
**Full Changelog**: https://github.com/zenml-io/zenml/compare/0.55.5...0.56.2
version = "0.56.2"
0.56.2
version: "0.56.2"
# example command for version 0.56.2
helm install my-zenml oci://public.ecr.aws/zenml/zenml --version 0.56.2
"""Release [0.56.2].

Revision ID: 0.56.2
Revises: 0701da9951a0
Create Date: 2024-03-25 14:49:49.021147

"""

# revision identifiers, used by Alembic.
revision = "0.56.2"
down_revision = "0701da9951a0"
branch_labels = None
depends_on = None


def upgrade() -> None:
    """Upgrade database schema and/or data, creating a new revision."""
    pass


def downgrade() -> None:
    """Downgrade database schema and/or data back to the previous revision."""
    pass