Homepage
About Snyk

sagemaker@2.63.2 vulnerabilities

Open source library for training and deploying models on Amazon SageMaker.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the sagemaker package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Deserialization of Untrusted Data

sagemaker is an Open source library for training and deploying models on Amazon SageMaker.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the base_deserializers.NumpyDeserializer module. An attacker can cause remote code execution, denial of service, affecting both confidentiality and integrity by passing untrusted data as pickled object arrays. This is only exploitable if pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with, are passed.

How to fix Deserialization of Untrusted Data?

Upgrade sagemaker to version 2.218.0 or higher.

[,2.218.0)
  • H
OS Command Injection

sagemaker is an Open source library for training and deploying models on Amazon SageMaker.

Affected versions of this package are vulnerable to OS Command Injection due to the capture_dependencies function in the sagemaker.serve.save_retrive.version_1_0_0.save.utils module. An attacker can execute arbitrary code or cause a denial of service by passing an inappropriate command as the requirements_path parameter.

How to fix OS Command Injection?

Upgrade sagemaker to version 2.214.3 or higher.

[,2.214.3)
Go back to all versions of this package