CVE-2024-34072: aws sagemaker-python-sdk Deserialization of Untrusted Data

Vulnerability summary

CVE-2024-34072 is a high (CVSS 7.8) Deserialization of Untrusted Data vulnerability in aws sagemaker-python-sdk. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.8% of scored vulnerabilities.

Timeline

1. 03-05-2024
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. Users are advised to upgrade to version 2.218.0. Users unable to upgrade should not pass pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with. Only pass pickled numpy object arrays from trusted sources.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.