CVE-2025-0508 - CVE House
Back to Database
Status published Medium CVE-2025-0508

MD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdk

Vulnerability Description

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This issue can cause integrity problems within the pipeline, potentially leading to erroneous processing outcomes.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-0508

Credits & Attribution

No credits recorded in the NVD database.

References

More from aws

View All →
CVE-2025-23206
IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk
Low 1.8
CVE-2024-45037
AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template
Medium 6.4
CVE-2024-34073
Command Injection in sagemaker-python-sdk
High 7.8
CVE-2024-34072
Deserialization of Untrusted Data in sagemaker-python-sdk
High 7.8
CVE-2024-32888
Amazon JDBC Driver for Redshift SQL Injection via line comment generation
Critical 10

Affected Vendor

Affected Software

aws/sagemaker-python-sdk
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: October 15th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-328

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.