« Volver al listado

CVE-2025-0508

Estado: AplazadaMedia (5.9)—

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This issue can cause integrity problems within the pipeline, potentially leading to erroneous processing outcomes.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Amazon — Sagemaker Python SDKAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-0508",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-0508",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-20T14:26:53.232640Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@huntr.dev",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security@huntr.dev",
      "affectedData": [
        {
          "vendor": "aws",
          "product": "aws/sagemaker-python-sdk",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "4965",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-20T10:15:53.283",
  "references": [
    {
      "url": "https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864",
      "source": "security@huntr.dev"
    },
    {
      "url": "https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2",
      "source": "security@huntr.dev"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@huntr.dev",
      "description": [
        {
          "lang": "en",
          "value": "CWE-328"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This issue can cause integrity problems within the pipeline, potentially leading to erroneous processing outcomes."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el componente SageMaker Workflow de aws/sagemaker-python-sdk permite la posibilidad de colisiones de hash MD5 en todas las versiones. Esto puede provocar que los flujos de trabajo se reemplacen inadvertidamente debido a la reutilización de resultados de diferentes configuraciones que generan el mismo hash MD5. Este problema puede causar problemas de integridad en la canalización, lo que podría generar resultados de procesamiento erróneos."
    }
  ],
  "lastModified": "2026-06-17T08:26:37.217",
  "sourceIdentifier": "security@huntr.dev"
}