Vulnerability	Vulnerable Version
H Deserialization of Untrusted Data sagemaker is an Open source library for training and deploying models on Amazon SageMaker. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the `base_deserializers.NumpyDeserializer` module. An attacker can cause remote code execution, denial of service, affecting both confidentiality and integrity by passing untrusted data as pickled object arrays. This is only exploitable if pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with, are passed. How to fix Deserialization of Untrusted Data? Upgrade `sagemaker` to version 2.218.0 or higher.	[,2.218.0)
H OS Command Injection sagemaker is an Open source library for training and deploying models on Amazon SageMaker. Affected versions of this package are vulnerable to OS Command Injection due to the `capture_dependencies` function in the `sagemaker.serve.save_retrive.version_1_0_0.save.utils` module. An attacker can execute arbitrary code or cause a denial of service by passing an inappropriate command as the `requirements_path` parameter. How to fix OS Command Injection? Upgrade `sagemaker` to version 2.214.3 or higher.	[,2.214.3)

Deserialization of Untrusted Data

sagemaker is an Open source library for training and deploying models on Amazon SageMaker.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the base_deserializers.NumpyDeserializer module. An attacker can cause remote code execution, denial of service, affecting both confidentiality and integrity by passing untrusted data as pickled object arrays. This is only exploitable if pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with, are passed.

How to fix Deserialization of Untrusted Data?

Upgrade sagemaker to version 2.218.0 or higher.

[,2.218.0)

OS Command Injection

sagemaker is an Open source library for training and deploying models on Amazon SageMaker.

Affected versions of this package are vulnerable to OS Command Injection due to the capture_dependencies function in the sagemaker.serve.save_retrive.version_1_0_0.save.utils module. An attacker can execute arbitrary code or cause a denial of service by passing an inappropriate command as the requirements_path parameter.

How to fix OS Command Injection?

Upgrade sagemaker to version 2.214.3 or higher.

[,2.214.3)

Go back to all versions of this package