// For flags

CVE-2024-34073

Command Injection in sagemaker-python-sdk

Severity Score

7.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils` module allows for potentially unsafe Operating System (OS) Command Injection if inappropriate command is passed as the “requirements_path” parameter. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. This issue has been addressed in version 2.214.3. Users are advised to upgrade. Users unable to upgrade should not override the “requirements_path” parameter of capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils`, and instead use the default value.

sagemaker-python-sdk es una librería para entrenar e implementar modelos de aprendizaje automático en Amazon SageMaker. En las versiones afectadas, la función capture_dependencies en el módulo `sagemaker.serve.save_retrive.version_1_0_0.save.utils` permite la inyección de comandos del sistema operativo (SO) potencialmente inseguro si se pasa un comando inapropiado como parámetro “requirements_path”. En consecuencia, esto puede permitir que un tercero sin privilegios provoque la ejecución remota de código y la denegación de servicio, afectando tanto la confidencialidad como la integridad. Este problema se solucionó en la versión 2.214.3. Se recomienda a los usuarios que actualicen. Los usuarios que no puedan actualizar no deben anular el parámetro "requirements_path" de la función capture_dependencies en `sagemaker.serve.save_retrive.version_1_0_0.save.utils` y, en su lugar, usar el valor predeterminado.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-04-30 CVE Reserved
  • 2024-05-03 CVE Published
  • 2024-05-04 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Aws
Search vendor "Aws"
 Sagemaker-python-sdk
Search vendor "Aws" for product "Sagemaker-python-sdk"
 < 2.214.3
Search vendor "Aws" for product "Sagemaker-python-sdk" and version " < 2.214.3"
en
Affected