OS Command Injection Affecting sagemaker package, versions [,2.214.3)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-SAGEMAKER-6808828
- published 5 May 2024
- disclosed 3 May 2024
- credit HiddenLayer, Kasimir123
Introduced: 3 May 2024
CVE-2024-34073 Open this link in a new tabHow to fix?
Upgrade sagemaker to version 2.214.3 or higher.
Overview
sagemaker is an Open source library for training and deploying models on Amazon SageMaker.
Affected versions of this package are vulnerable to OS Command Injection due to the capture_dependencies function in the sagemaker.serve.save_retrive.version_1_0_0.save.utils module. An attacker can execute arbitrary code or cause a denial of service by passing an inappropriate command as the requirements_path parameter.
Workaround
Do not override the requirements_path parameter of capture_dependencies function in sagemaker.serve.save_retrive.version_1_0_0.save.utils, instead use the default value.