Aller au contenu
en Se connecter
7.2 Élevée

CVE-2026-83551 Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker…

Description

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.

Produits et versions touchés

Produit Versions touchées Corrigé en
sagemaker-python-sdk 3.11 premières → < 3.11.0 3.11.0
sagemaker-python-sdk 2.256 premières → < 2.256.0 2.256.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de sagemaker-python-sdk

Les 3 CVE de sagemaker-python-sdk →
CVE-2024-34072 sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker 7.8 Élevée CVE-2024-34073 sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker 7.8 Élevée
Suivre cette CVE