PT-2024-25684 · Amazon · Sagemaker-Python-Sdk

Kasimir123 · Published 2024-05-03 · Updated 2024-05-03 · CVE-2024-34073

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sagemaker-python-sdk versions prior to 2.214.3

Description The capture dependencies function in the sagemaker.serve.save retrive.version 1 0 0.save.utils module allows for potentially unsafe Operating System (OS) Command Injection if an inappropriate command is passed as the requirements path parameter. This may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity.

Recommendations For versions prior to 2.214.3, upgrade to version 2.214.3 or later. As a temporary workaround for users unable to upgrade, do not override the requirements path parameter of the capture dependencies function in sagemaker.serve.save retrive.version 1 0 0.save.utils, and instead use the default value.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-34073

GHSA-7PC3-PR3Q-58VG

Affected Products

Sagemaker-Python-Sdk

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34073.json · Exploit
• https://osv.dev/vulnerability/GHSA-7pc3-pr3q-58vg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34073 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34073 · Vendor Advisory
• https://github.com/aws/sagemaker-python-sdk · Note
• https://github.com/aws/sagemaker-python-sdk/commit/2d873d53f708ea570fc2e2a6974f8c3097fe9df5 · Note
• https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-7pc3-pr3q-58vg · Note
• https://github.com/aws/sagemaker-python-sdk/pull/4556 · Note
• https://twitter.com/CVEnew/status/1786408493869629570 · Twitter Post
• https://twitter.com/hiddenlayersec/status/1786433911402172736 · Twitter Post
• https://twitter.com/hiddenlayersec/status/1786429567432827054 · Twitter Post
• https://t.me/cvenotify/79022 · Telegram Post