PT-2025-12317 · Amazon · Aws/Sagemaker-Python-Sdk

Published 2025-03-20 · Updated 2025-03-20 · CVE-2025-0508

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions aws/sagemaker-python-sdk (affected versions not specified)

Description The issue concerns a problem with MD5 hash collisions in the SageMaker Workflow component. This can cause workflows to be inadvertently replaced due to the reuse of results from different configurations that generate the same MD5 hash, potentially leading to integrity problems within the pipeline and erroneous processing outcomes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-328

CWE-440

Related Identifiers

CVE-2025-0508

GHSA-32G6-MG92-GHM2

Affected Products

Aws/Sagemaker-Python-Sdk

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-0508 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0508 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-32g6-mg92-ghm2 · Vendor Advisory
• https://github.com/aws/sagemaker-python-sdk · Note
• https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864 · Note
• https://t.me/cvetracker/19523 · Telegram Post
• https://t.me/cvedetector/20709 · Telegram Post
• https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2 · Note
• https://twitter.com/CVEnew/status/1902670976497926342 · Twitter Post