Vulnerabilities for sagemaker

First version without a known vulnerability: 3.8.0

Details

• GHSA-rq6v-x3j8-7qgf2026-05-21

  Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler

  Fixed in: 2.257.2, 3.8.0

• GHSA-7hh5-prp2-mfh52026-05-21

  Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

  Fixed in: 2.257.2, 3.8.0

• GHSA-5r2p-pjr8-7fh72026-03-05

  SageMaker Python SDK replaced eval() with safe parser in JumpStart search functionality

  Fixed in: 3.4.0

• GHSA-rjrp-m2jw-pv9c2026-02-02

  SageMaker Python SDK has Exposed HMAC

  Fixed in: 3.2.0, 2.256.0

• GHSA-62rc-f4v9-h5432026-02-02

  SageMaker Python SDK has Insecure TLS Configuration

  Fixed in: 3.1.1, 2.256.0

• GHSA-32g6-mg92-ghm22025-03-20

  SageMaker Workflow component allows possibility of MD5 hash collisions

  Fixed in: 2.237.3

• GHSA-7pc3-pr3q-58vg2024-05-03

  sagemaker-python-sdk Command Injection vulnerability

  Fixed in: 2.214.3

• GHSA-wjvx-jhpj-r54r2024-05-03

  sagemaker-python-sdk vulnerable to Deserialization of Untrusted Data

  Fixed in: 2.218.0