SageMaker Python SDK vulnerabilities
4 known vulnerabilities in SageMaker Python SDK from AWS. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
sagemaker-python-sdk: Cleartext Storage of Sensitive Information
Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline
- 7.2 High severity
SageMaker Python SDK: Cleartext Transmission of Sensitive Information
The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissions to modify objects
- 7.8 High severity
sagemaker-python-sdk: Improper Neutralization of Special Elements used in an OS Command
sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils` module allows for potentially unsafe Ope
- 7.8 High severity
sagemaker-python-sdk: Deserialization of Untrusted Data
sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickl