PT-2024-25684 · Amazon · Sagemaker-Python-Sdk

Kasimir123 · CVE-2024-34073 · Published 2024-05-03 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sagemaker-python-sdk versions prior to 2.214.3

Description The capture dependencies function in the sagemaker.serve.save retrive.version 1 0 0.save.utils module allows for potentially unsafe Operating System (OS) Command Injection if an inappropriate command is passed as the requirements path parameter. This may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity.

Recommendations For versions prior to 2.214.3, upgrade to version 2.214.3 or later. As a temporary workaround for users unable to upgrade, do not override the requirements path parameter of the capture dependencies function in sagemaker.serve.save retrive.version 1 0 0.save.utils, and instead use the default value.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-34073

GHSA-7PC3-PR3Q-58VG

PYSEC-2026-1887

Affected Products

Sagemaker-Python-Sdk

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34073.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34073 · Security Note
• https://osv.dev/vulnerability/GHSA-7pc3-pr3q-58vg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34073 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-1887 · Vendor Advisory
• https://github.com/aws/sagemaker-python-sdk · Note
• https://github.com/aws/sagemaker-python-sdk/pull/4556 · Note
• https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-7pc3-pr3q-58vg · Note
• https://github.com/aws/sagemaker-python-sdk/commit/2d873d53f708ea570fc2e2a6974f8c3097fe9df5 · Note
• https://t.me/cvenotify/79022 · Telegram Post
• https://twitter.com/CVEnew/status/1786408493869629570 · Twitter Post
• https://github.com/advisories/GHSA-7pc3-pr3q-58vg · Note
• https://twitter.com/hiddenlayersec/status/1786433911402172736 · Twitter Post
• https://twitter.com/hiddenlayersec/status/1786429567432827054 · Twitter Post
• https://pypi.org/project/sagemaker · Note