ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.
MD5 hash collision vulnerability in AWS SageMaker Python SDK
AWS SageMaker Python SDK was using MD5 hashing for file integrity checks in workflows, which is vulnerable to collision attacks. AWS patched the vulnerability by replacing MD5 with SHA256.
AII-1001-858893 sources β
What happened
The SageMaker Python SDK used MD5 hashing for file and object integrity checks in its workflow utilities module.
MD5 is cryptographically broken and vulnerable to collision attacks, allowing attackers to craft different inputs with identical hashes.
Governance controls
AWS patched the vulnerability by replacing MD5 with SHA256 hashing across the hash_object, hash_file, and hash_files_or_dirs functions in the workflow utilities module.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.
github.com
https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864