CVSS 3.1 Score 7.8 of 10 (high)


Published May 3, 2024
CWE ID 502


CVE-2024-34072 is a vulnerability in the sagemaker-python-sdk library, specifically in the sagemaker.base_deserializers.NumpyDeserializer module before version 2.218.0. This vulnerability allows for potentially unsafe deserialization of pickled object arrays when untrusted data is passed. As a result, an attacker could exploit this vulnerability to execute remote code, cause denial of service, and compromise confidentiality and integrity. To remediate this vulnerability, users are advised to upgrade to version 2.218.0 or higher. If upgrading is not possible, it is recommended not to pass pickled numpy object arrays from untrusted sources or that may have been tampered with, and only use arrays from trusted sources.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-34072 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options