CVE-2024-34072

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-34072", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-30T06:56:33.381Z", "datePublished": "2024-05-03T10:13:24.557Z", "dateUpdated": "2024-08-02T02:42:59.895Z"}, "containers": {"cna": {"title": "Deserialization of Untrusted Data in sagemaker-python-sdk", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r"}, {"name": "https://github.com/aws/sagemaker-python-sdk/pull/4557", "tags": ["x_refsource_MISC"], "url": "https://github.com/aws/sagemaker-python-sdk/pull/4557"}], "affected": [{"vendor": "aws", "product": "sagemaker-python-sdk", "versions": [{"version": "< 2.218.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-03T10:13:24.557Z"}, "descriptions": [{"lang": "en", "value": "sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. Users are advised to upgrade to version 2.218.0. Users unable to upgrade should not pass pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with. Only pass pickled numpy object arrays from trusted sources."}], "source": {"advisory": "GHSA-wjvx-jhpj-r54r", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-34072", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-03T17:28:15.418668Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:aws:sagemaker-python-sdk:-:*:*:*:*:*:*:*"], "vendor": "aws", "product": "sagemaker-python-sdk", "versions": [{"status": "affected", "version": "-", "lessThan": "2.218.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:41:18.622Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:42:59.895Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r"}, {"name": "https://github.com/aws/sagemaker-python-sdk/pull/4557", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/aws/sagemaker-python-sdk/pull/4557"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r", "name": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/aws/sagemaker-python-sdk/pull/4557", "name": "https://github.com/aws/sagemaker-python-sdk/pull/4557", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:42:59.895Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-34072", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-03T17:28:15.418668Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:aws:sagemaker-python-sdk:-:*:*:*:*:*:*:*"], "vendor": "aws", "product": "sagemaker-python-sdk", "versions": [{"status": "affected", "version": "-", "lessThan": "2.218.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-03T17:34:03.624Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Deserialization of Untrusted Data in sagemaker-python-sdk", "source": {"advisory": "GHSA-wjvx-jhpj-r54r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "aws", "product": "sagemaker-python-sdk", "versions": [{"status": "affected", "version": "< 2.218.0"}]}], "references": [{"url": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r", "name": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/aws/sagemaker-python-sdk/pull/4557", "name": "https://github.com/aws/sagemaker-python-sdk/pull/4557", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. Users are advised to upgrade to version 2.218.0. Users unable to upgrade should not pass pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with. Only pass pickled numpy object arrays from trusted sources."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-03T10:13:24.557Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34072", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:42:59.895Z", "dateReserved": "2024-04-30T06:56:33.381Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-05-03T10:13:24.557Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "sagemaker-python-sdk", "vendor": "aws", "versions": [{"status": "affected", "version": "< 2.218.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:aws:sagemaker-python-sdk:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "sagemaker-python-sdk", "vendor": "aws", "versions": [{"lessThan": "2.218.0", "status": "affected", "version": "-", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. Users are advised to upgrade to version 2.218.0. Users unable to upgrade should not pass pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with. Only pass pickled numpy object arrays from trusted sources."}, {"lang": "es", "value": "sagemaker-python-sdk es una librer\u00eda para entrenar e implementar modelos de aprendizaje autom\u00e1tico en Amazon SageMaker. El m\u00f3dulo sagemaker.base_deserializers.NumpyDeserializer anterior a v2.218.0 permite una deserializaci\u00f3n potencialmente insegura cuando se pasan datos que no son de confianza como matrices de objetos encurtidos. En consecuencia, esto puede permitir que un tercero sin privilegios provoque la ejecuci\u00f3n remota de c\u00f3digo y la denegaci\u00f3n de servicio, afectando tanto la confidencialidad como la integridad. Se recomienda a los usuarios que actualicen a la versi\u00f3n 2.218.0. Los usuarios que no puedan actualizar no deben pasar conjuntos de objetos numerosos y encurtidos que se originaron en una fuente que no es de confianza o que podr\u00edan haber sido manipulados. Pase \u00fanicamente matrices de objetos numerosos encurtidos de fuentes confiables."}], "id": "CVE-2024-34072", "lastModified": "2026-06-17T07:32:51.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-34072", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-05-03T17:28:15.418668Z", "version": "2.0.3"}}]}, "published": "2024-05-03T11:15:22.260", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/aws/sagemaker-python-sdk/pull/4557"}, {"source": "security-advisories@github.com", "url": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/aws/sagemaker-python-sdk/pull/4557"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-wjvx-jhpj-r54r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}