GitHub Advisoryadvisory · PyPI

GHSA-32g6-mg92-ghm2 SageMaker Workflow component allows possibility of MD5 hash collisions

MEDIUM Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2025-0508
Ecosystem
PyPI
Packages
sagemaker
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-328, CWE-440
Reviewed
2025-03-21

Affected packages

• PyPI sagemaker: < 2.237.3 → fixed in 2.237.3

Description

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This issue can cause integrity problems within the pipeline, potentially leading to erroneous processing outcomes.

Related

Alias · CVE (1)

  • CVE-2025-0508 A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all… vulnerability

Weakness · CWE (2)

  • CWE-328 Use of Weak Hash weakness
  • CWE-440 Expected Behavior Violation weakness

References