PyPI/sagemaker CVE-2025-0508: medium 5.9, EPSS 0.27%
SageMaker Workflow component allows possibility of MD5 hash collisions
Action: Upgrade sagemaker to 2.237.3 or later.
pip install sagemaker==2.237.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.237.3 | - |
Fixed versions
| 2.237.3 |
Sources
- osv: PYSEC-2026-1885
- https://nvd.nist.gov/vuln/detail/CVE-2025-0508
- https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864
- https://github.com/aws/sagemaker-python-sdk
- https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2
- https://pypi.org/project/sagemaker
- https://github.com/advisories/GHSA-32g6-mg92-ghm2
CVE-2025-0508 · published · modified · JSON