CVE-2024-34073: 
Python vulnerability analysis and mitigation

sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. A command injection vulnerability was discovered in versions prior to 2.214.3, specifically in the capture_dependencies function within the sagemaker.serve.save_retrive.version_1_0_0.save.utils module (GitHub Advisory, NVD).

The vulnerability exists in the capture_dependencies function where improper handling of the 'requirements_path' parameter could allow for Operating System (OS) Command Injection. The issue stems from unsafe command execution when processing the requirements_path parameter. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local attack vector, low attack complexity, no privileges required, and user interaction required (GitHub Advisory).

Successful exploitation of this vulnerability could allow an unprivileged third party to achieve remote code execution and cause denial of service. The impact affects both confidentiality and integrity of the system. The high severity rating indicates significant potential damage if exploited (GitHub Advisory).

The vulnerability requires local access and user interaction to exploit, but does not require privileges. The attack complexity is rated as low, making it relatively straightforward to exploit if the conditions are met (GitHub Advisory).

The vulnerability has been patched in version 2.214.3. Users are strongly advised to upgrade to this version or later. For those unable to upgrade immediately, a workaround is available: do not override the 'requirements_path' parameter of capture_dependencies function in sagemaker.serve.save_retrive.version_1_0_0.save.utils, and instead use the default value (GitHub Advisory).

HiddenLayer was credited for collaborating on this issue through the coordinated vulnerability disclosure process. AWS has requested that any questions or comments about this advisory be directed to AWS/Amazon Security via their vulnerability reporting page or directly via email, rather than creating public GitHub issues (GitHub Advisory).