{"data":{"id":"3aae84ee-bd1a-435d-8dfd-e31ab6993b3a","title":"CVE-2024-34072: sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The…","summary":"The sagemaker.base_deserializers.NumpyDeserializer module in sagemaker-python-sdk before v2.218.0 performs unsafe deserialization when untrusted data is passed as pickled object arrays. An unprivileged third party may exploit this to cause remote code execution or denial of service, affecting confidentiality and integrity.","solution":"Upgrade to version 2.218.0. Users unable to upgrade should not pass pickled numpy object arrays that originated from an untrusted source or could have been tampered with, and should only pass pickled numpy object arrays from trusted sources.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-34072","publishedAt":"2024-05-03T11:15:22.260Z","cveId":"CVE-2024-34072","cweIds":["CWE-502"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["sagemaker@< 2.218.0 (fixed: 2.218.0)"],"affectedPackageNames":["sagemaker"],"affectedPackageRefs":["pypi:sagemaker"],"affectedVendors":["Amazon"],"affectedVendorsRaw":["Amazon SageMaker","sagemaker-python-sdk"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"sagemaker-python-sdk unsafe deserialization of pickled numpy object arrays","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00411,"epssCheckedAt":"2026-11-04T06:10:13.969Z","kevDateAdded":null,"advisoryAliases":["GHSA-wjvx-jhpj-r54r"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:08.528Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-05-01T21:14:37.062Z","daysToFix":-2,"fixCheckedAt":"2026-10-29T21:46:03.883Z","capecIds":["CAPEC-586"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"pypi","name":"sagemaker","fixedVersion":"2.218.0","matchedVersion":"2.218.0","fixReleasedAt":"2024-05-01T21:14:37.062Z","daysToFix":-2,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:03.731Z"}]}}