OS Command Injection

sagemaker is vulnerable to OS Command Injection. The vulnerability is due to the capturedependencies function in the sagemaker.serve.saveretrive.version100.save.utils module. An attacker can execute arbitrary code or cause a denial of service by passing an inappropriate command as the...

Deserialization Of Untrusted Data

sagemaker is vulnerable to Deserialization of Untrusted Data. The vulnerability is due the deserialization of pickled object arrays within the sagemaker.basedeserializers.NumpyDeserializer module, which could allow an unprivileged third party to cause Remote Code Execution or Denial of Service...

ezsmdeploy (0.2.9) potentially affected by CVE-2024-34073 via sagemaker (1.60.0)

sagemaker PYPI version 1.60.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy 0.2.9 Source cves: CVE-2024-34073 Source advisory: OSV:GHSA-7PC3-PR3Q-58VG...

hydro-integrations (2.3.0.dev0) potentially affected by CVE-2024-34073 via sagemaker (1.52.1)

sagemaker PYPI version 1.52.1 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - hydro-integrations 2.3.0.dev0 Source cves: CVE-2024-34073 Source advisory: OSV:GHSA-7PC3-PR3Q-58VG...

GHSA-7PC3-PR3Q-58VG sagemaker-python-sdk Command Injection vulnerability

Impact The capturedependencies function in sagemaker.serve.saveretrive.version100.save.utils module before version 2.214.3 allows for potentially unsafe Operating System OS Command Injection if inappropriate command is passed as the “requirementspath” parameter. This consequently may allow an...

anymodality (0.1.0), autogluon-cloud (>=0.1.1b20230324, <=0.2.1b20230929) +21 more potentially affected by CVE-2024-34073 via sagemaker (>=2.16.1, <=2.207.1)

sagemaker PYPI version =2.16.1, =0.1.1b20230324, =0.1.17, =0.9.0, =1.0.0, =1.97.0.dev0, =1.0.0, =1.0.0, =0.1.2, =0.0.9, =0.1.6, =0.0.1, =0.2.0, =0.5.1 and more Source cves: CVE-2024-34073 Source advisory: OSV:GHSA-7PC3-PR3Q-58VG...

ezsmdeploy (>=0.2.8, <=0.3.1) potentially affected by CVE-2024-34073 via sagemaker (1.58.2)

sagemaker PYPI version 1.58.2 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy =0.2.8, =0.3.1 Source cves: CVE-2024-34073 Source advisory: OSV:GHSA-7PC3-PR3Q-58VG...

anymodality (0.1.0), autogluon-cloud (>=0.1.1b20230324, <=0.2.1b20230929) +21 more potentially affected by CVE-2024-34073 via sagemaker (>=2.16.1, <=2.207.1)

sagemaker PYPI version =2.16.1, =0.1.1b20230324, =0.1.17, =0.9.0, =1.0.0, =1.97.0.dev0, =1.0.0, =1.0.0, =0.1.2, =0.0.9, =0.1.6, =0.0.1, =0.2.0, =0.5.1 and more Source cves: CVE-2024-34073 Source advisory: GHSA-7PC3-PR3Q-58VG...

sagemaker-python-sdk vulnerable to Deserialization of Untrusted Data

Impact sagemaker.basedeserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both...

GHSA-WJVX-JHPJ-R54R sagemaker-python-sdk vulnerable to Deserialization of Untrusted Data

Impact sagemaker.basedeserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both...

ezsmdeploy (>=0.2.8, <=0.3.1) potentially affected by CVE-2024-34072 via sagemaker (1.58.2)

sagemaker PYPI version 1.58.2 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy =0.2.8, =0.3.1 Source cves: CVE-2024-34072 Source advisory: OSV:GHSA-WJVX-JHPJ-R54R...

anymodality (0.1.0), autogluon-cloud (>=0.1.1b20230324, <=0.2.1b20230929) +21 more potentially affected by CVE-2024-34072 via sagemaker (>=2.16.1, <=2.207.1)

sagemaker PYPI version =2.16.1, =0.1.1b20230324, =0.1.17, =0.9.0, =1.0.0, =1.97.0.dev0, =1.0.0, =1.0.0, =0.1.2, =0.0.9, =0.1.6, =0.0.1, =0.2.0, =0.5.1 and more Source cves: CVE-2024-34072 Source advisory: OSV:GHSA-WJVX-JHPJ-R54R...

anymodality (0.1.0), autogluon-cloud (>=0.1.1b20230324, <=0.2.1b20230929) +21 more potentially affected by CVE-2024-34072 via sagemaker (>=2.16.1, <=2.207.1)

sagemaker PYPI version =2.16.1, =0.1.1b20230324, =0.1.17, =0.9.0, =1.0.0, =1.97.0.dev0, =1.0.0, =1.0.0, =0.1.2, =0.0.9, =0.1.6, =0.0.1, =0.2.0, =0.5.1 and more Source cves: CVE-2024-34072 Source advisory: GHSA-WJVX-JHPJ-R54R...

ezsmdeploy (0.2.9) potentially affected by CVE-2024-34072 via sagemaker (1.60.0)

sagemaker PYPI version 1.60.0 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - ezsmdeploy 0.2.9 Source cves: CVE-2024-34072 Source advisory: OSV:GHSA-WJVX-JHPJ-R54R...

hydro-integrations (2.3.0.dev0) potentially affected by CVE-2024-34072 via sagemaker (1.52.1)

sagemaker PYPI version 1.52.1 is affected by a known vulnerability. The following packages have a transitive dependency on sagemaker and may be impacted: - hydro-integrations 2.3.0.dev0 Source cves: CVE-2024-34072 Source advisory: OSV:GHSA-WJVX-JHPJ-R54R...

CVE-2024-34073

sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capturedependencies function in sagemaker.serve.saveretrive.version100.save.utils module allows for potentially unsafe Operating System OS Command Injection if...

CVE-2024-34072

sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.basedeserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently ma...

CVE-2024-34072 Deserialization of Untrusted Data in sagemaker-python-sdk

sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.basedeserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently ma...

CVE-2024-34072 Deserialization of Untrusted Data in sagemaker-python-sdk

sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.basedeserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently ma...

anymodality (0.1.0), autogluon-cloud (>=0.1.1b20230324, <=0.2.1b20230929) +22 more potentially affected by CVE-2024-34072 via sagemaker (>=1.52.1, <=2.207.1)

sagemaker PYPI version =1.52.1, =0.1.1b20230324, =0.1.17, =0.9.0, =0.2.8, =1.97.0.dev0, =1.0.0, =1.0.0, =0.1.2, =0.0.9, =0.1.6, =0.0.1, =0.0.4 and more Source cves: CVE-2024-34072 Source advisory: MEND:CVE-2024-34072...