Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils.py

## Summary Amazon SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue exists where repository credentials are included in log output when a Git clone operation fails. ## Impact The `_runclone_command()` function in the `git_utils.py` component does not redact repository credentials from subprocess error output. When a Git clone operation fails, plaintext credentials might be written to CloudWatch Logs. An authenticated remote user with access to those logs is able to obtain the credentials. **Impacted versions:** * Amazon SageMaker Python SDK V2 versions before 2.257.3 * Amazon SageMaker Python SDK V3 versions from 3.0.0 through 3.9.x ## Patches This issue has been addressed in Amazon SageMaker Python SDK V2 version 2.257.3 and V3 version 3.10.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the fixes. ## Workarounds If immediate upgrading is not possible, avoid including credentials in Git repository URLs and restrict access to CloudWatch Logs containing Amazon SageMaker Python SDK output. Review logs from failed Git clone operations and rotate any credentials that were present in the affected log output. ## References If you have any questions or comments about this advisory, we ask that you contact AWS Security through our vulnerability reporting page at [https://aws.amazon.com/security/vulnerability-reporting/](https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue. ## Acknowledgement We would like to thank Gouri Sankar A for collaborating on this issue through the coordinated vulnerability disclosure process.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-532

• github.com/aws/sagemaker-python-sdk/security/advisories/GHSA-g6w4-jvgp-68x2
• github.com/aws/sagemaker-python-sdk