starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2016-5829 (published 2016-06-27T10:59Z)

Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Scott Bauer
author_date: 2016-06-23 08:59:47-06:00
msg: HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands

This patch validates the num_values parameter from userland during the
HIDIOCGUSAGES and HIDIOCSUSAGES commands. Previously, if the report id was set
to HID_REPORT_ID_UNKNOWN, we would fail to validate the num_values parameter
leading to a heap overflow.

Cc: stable@vger.kernel.org
Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: hiddev.c
change_type: ModificationType.MODIFY
diff: @@ -516,13 +516,13 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
 					goto inval;
 			} else if (uref->usage_index >= field->report_count)
 				goto inval;
-
-			else if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
-				 (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
-				  uref->usage_index + uref_multi->num_values > field->report_count))
-				goto inval;
 		}
 
+		if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
+		    (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
+		     uref->usage_index + uref_multi->num_values > field->report_count))
+			goto inval;
+
 		switch (cmd) {
 		case HIDIOCGUSAGE:
 			uref->value = field->value[uref->usage_index];

programming_language: C
CVE-2021-45926 (published 2022-01-01T01:15Z)

MDB Tools (aka mdbtools) 0.9.2 has a stack-based buffer overflow (at 0x7ffd0c689be0) in mdb_numeric_to_string (called from mdb_xfer_bound_data and _mdb_attempt_bind).

Severity: MEDIUM
CVSS v2 base score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/mdbtools/mdbtools
commit_details: repo_url: https://github.com/mdbtools/mdbtools
author: Evan Miller
author_date: 2021-05-01 07:03:58-04:00
msg: Version 0.9.3, final
repository: repo_url: https://github.com/mdbtools/mdbtools
repo_name: mdbtools/mdbtools
description: MDB Tools - Read Access databases on *nix
repo_language: C
owner: mdbtools
file_changes: filename: NEWS
change_type: ModificationType.MODIFY
diff: @@ -1,45 +1,28 @@
-Version 0.9.3, Beta 4
-=============
-
-libmdb:
-* Fix build failure with emscripten #299
-
-Version 0.9.3, Beta 3
-=============
-
-libmdb / libmdbsql:
-* Fix build when _XOPEN_SOURCE was already defined on the platform #298
-
-Version 0.9.3, Beta 2
-=============
-
-libmdb:
-* Migrate to g_memdup2 #287 #288
-
-libmdbsql:
-* Allow double quoted (") database names #291
-* Allow spaces in database names #292 #293
-
-Docs:
-* Add JET version for access 2013/2016/2019 to docs #286
-
-Version 0.9.3, Beta 1
+Version 0.9.3
 =============
 
 libmdb:
 * Support files created with Access 2019 #260 #277
 * Fix a warning when reading in binary property values #262
 * Fix signed-unsigned comparison warning #269
+* Migrate to `g_memdup2` #287 #288
+* Fix build when `_XOPEN_SOURCE` was already defined on the platform #298
+* Fix build failure with emscripten #299
 
 libmdbsql:
 * Support negative floating point literals #274 #279
-* Comparison operators behaved incorrectly when the constant was on the left #283 #285
 * Improved support for file paths in `CONNECT TO` statements #275 #280 #282
+* Comparison operators behaved incorrectly when the constant was on the left #283 #285
+* Allow double quoted (") database names #291
+* Allow spaces in database names #292 #293
 
 ODBC:
 * unixODBC now uses the `--libdir` passed at configure-time #261
 * Fix a segfault in PyODBC when `SQLGetTypeInfo` is called on an unsupported data type #278
 
+Docs:
+* Add JET version for access 2013/2016/2019 to docs #286
+
 Version 0.9.2
 =============
 

programming_language: Markdown
filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
 dnl Process this file with autoconf to produce a configure script.
-AC_INIT([mdbtools],[0.9.3-beta4],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])
+AC_INIT([mdbtools],[0.9.3],[https://github.com/mdbtools/mdbtools/issues],[],[https://github.com/mdbtools/mdbtools])
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_SRCDIR(src/extras/mdb-dump.c)

programming_language: Shell
CVE-2022-0137 (published 2022-11-14T18:15Z)

A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/michaelrsweet/htmldoc
commit_details: repo_url: https://github.com/michaelrsweet/htmldoc
author: Michael R Sweet
author_date: 2021-12-30 13:34:50-05:00
msg: Fix potential heap overflow bug with GIF images (Issue #461)
repository: repo_url: https://github.com/michaelrsweet/htmldoc
repo_name: michaelrsweet/htmldoc
description: HTML Conversion Software
repo_language: C++
owner: michaelrsweet
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,8 @@
+# Changes in HTMLDOC v1.9.15
+
+- Fixed a potential heap overflow bug with GIF images (Issue #461)
+
+
 # Changes in HTMLDOC v1.9.14
 
 - BMP image support is now deprecated and will be removed in a future

programming_language: Markdown
filename: image.cxx
change_type: ModificationType.MODIFY
diff: @@ -1312,6 +1312,13 @@ image_load_gif(image_t *img,	/* I - Image pointer */
 	      return (-1);
 	  }
 
+          img->width  = (buf[5] << 8) | buf[4];
+          img->height = (buf[7] << 8) | buf[6];
+          img->depth  = gray ? 1 : 3;
+
+	  if (img->width <= 0 || img->width > 32767 || img->height <= 0 || img->height > 32767)
+	    return (-1);
+
           if (transparent >= 0)
           {
            /*
@@ -1343,13 +1350,6 @@ image_load_gif(image_t *img,	/* I - Image pointer */
             image_need_mask(img);
 	  }
 
-          img->width  = (buf[5] << 8) | buf[4];
-          img->height = (buf[7] << 8) | buf[6];
-          img->depth  = gray ? 1 : 3;
-
-	  if (img->width <= 0 || img->width > 32767 || img->height <= 0 || img->height > 32767)
-	    return (-1);
-
 	  if (!load_data)
 	    return (0);
 
@@ -1784,7 +1784,7 @@ image_set_mask(image_t *img,	/* I - Image to operate on */
 
 
   if (img == NULL || img->mask == NULL || x < 0 || x >= img->width ||
-      y < 0 || y > img->height)
+      y < 0 || y >= img->height)
     return;
 
   if (img->maskscale == 8)

programming_language: C
CVE-2021-42362 (published 2021-11-17T18:15Z)

The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.\n\n

Severity: MEDIUM
CVSS v2 base score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/cabrerahector/wordpress-popular-posts
commit_details: repo_url: https://github.com/cabrerahector/wordpress-popular-posts
author: Héctor Cabrera
author_date: 2021-06-03 11:09:16-04:00
msg: Image: verifies that URLs are images
repository: repo_url: https://github.com/cabrerahector/wordpress-popular-posts
repo_name: cabrerahector/wordpress-popular-posts
description: WordPress Popular Posts - A highly customizable WordPress widget that displays your most popular posts.
repo_language: PHP
owner: cabrerahector
file_changes: filename: Image.php
change_type: ModificationType.MODIFY
diff: @@ -624,6 +624,9 @@ class Image {
      */
     private function fetch_external_image($id, $url)
     {
+        if ( ! $this->is_image_url($url) )
+            return false;
+
         $full_image_path = trailingslashit($this->get_plugin_uploads_dir()['basedir']) . "{$id}_" . sanitize_file_name(rawurldecode(wp_basename($url)));
 
         // if the file exists already, return URL and path
@@ -932,6 +935,15 @@ class Image {
         if ( ! filter_var($parse_url, FILTER_VALIDATE_URL) )
             return false;
 
+        // Check extension
+        $file_name = basename($path);
+        $file_name = sanitize_file_name($file_name);
+        $ext = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));
+        $allowed_ext = ['jpg', 'jpeg', 'png', 'gif'];
+
+        if ( ! in_array($ext, $allowed_ext) )
+            return false;
+
         // sanitize URL, just in case
         $image_url = esc_url($url);
         // remove querystring

programming_language: PHP
CVE-2015-10055 (published 2023-01-16T18:15Z)

A vulnerability was found in PictureThisWebServer and classified as critical. This issue affects the function router.post of the file routes/user.js. The manipulation of the argument username/password leads to sql injection. The patch is named 68b9dc346e88b494df00d88c7d058e96820e1479. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218399.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/jan-rodriguez/PictureThisWebServer
commit_details: repo_url: https://github.com/jan-rodriguez/PictureThisWebServer
author: jkr241
author_date: 2015-02-23 20:52:32-05:00
msg: Fixed error and prevent sql injection
repository: repo_url: https://github.com/jan-rodriguez/PictureThisWebServer
repo_name: jan-rodriguez/PictureThisWebServer
repo_language: JavaScript
owner: jan-rodriguez
file_changes: filename: user.js
change_type: ModificationType.MODIFY
diff: @@ -18,7 +18,6 @@ router.get('/all', function(req, res, next) {
 
 /* POST create user */
 router.post('/new', function(req, res, next) {
-  console.log(req.body);
 
   var username = req.body.username;
   var password = req.body.password;
@@ -29,6 +28,10 @@ router.post('/new', function(req, res, next) {
     return;
   }
 
+  //SQL INJECTION SHALL NOT PASS!!!
+  var username = conn.escape(username);
+  var password = conn.escape(password);
+
   var conn = mysql.createConnection({
     host    : "ec2-52-1-159-248.compute-1.amazonaws.com",
     user    : "root",
@@ -48,7 +51,7 @@ router.post('/new', function(req, res, next) {
     conn.query("INSERT INTO user (username, password) VALUES ('"+username+"', '"+password+"')", function (err, result) {
       if(err) {
         //Duplicate code
-        if(err.code === "ER_DUP_UNIQUE") {
+        if(err.code === "ER_DUP_ENTRY") {
           res.json({error: "Username already exists."});
         }else{
           console.error("********Failed to insert user**********");

programming_language: JavaScript
CVE-2024-0639 (published 2024-01-17T16:15Z)

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.

CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-667
cwe_name: Improper Locking
description: The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
extended_description: 
	   Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process.  This can lead to data or memory corruption, denial of service, etc.
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Chengfeng Ye
author_date: 2023-06-27 12:03:40+00:00
msg: sctp: fix potential deadlock on &net->sctp.addr_wq_lock

As &net->sctp.addr_wq_lock is also acquired by the timer
sctp_addr_wq_timeout_handler() in protocal.c, the same lock acquisition
at sctp_auto_asconf_init() seems should disable irq since it is called
from sctp_accept() under process context.

Possible deadlock scenario:
sctp_accept()
    -> sctp_sock_migrate()
    -> sctp_auto_asconf_init()
    -> spin_lock(&net->sctp.addr_wq_lock)
        <timer interrupt>
        -> sctp_addr_wq_timeout_handler()
        -> spin_lock_bh(&net->sctp.addr_wq_lock); (deadlock here)

This flaw was found using an experimental static analysis tool we are
developing for irq-related deadlock.

The tentative patch fix the potential deadlock by spin_lock_bh().

Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Fixes: 34e5b0118685 ("sctp: delay auto_asconf init until binding the first addr")
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/20230627120340.19432-1-dg573847474@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: socket.c
change_type: ModificationType.MODIFY
diff: @@ -364,9 +364,9 @@ static void sctp_auto_asconf_init(struct sctp_sock *sp)
 	struct net *net = sock_net(&sp->inet.sk);
 
 	if (net->sctp.default_auto_asconf) {
-		spin_lock(&net->sctp.addr_wq_lock);
+		spin_lock_bh(&net->sctp.addr_wq_lock);
 		list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist);
-		spin_unlock(&net->sctp.addr_wq_lock);
+		spin_unlock_bh(&net->sctp.addr_wq_lock);
 		sp->do_auto_asconf = 1;
 	}
 }

programming_language: C
CVE-2021-38200 (published 2021-08-08T20:15Z)

arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perf_event_paranoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service (perf_instruction_pointer NULL pointer dereference and OOPS) via a "perf record" command.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Athira Rajeev
author_date: 2021-06-17 13:55:06-04:00
msg: powerpc/perf: Fix crash in perf_instruction_pointer() when ppmu is not set

On systems without any specific PMU driver support registered, running
perf record causes Oops.

The relevant portion from call trace:

  BUG: Kernel NULL pointer dereference on read at 0x00000040
  Faulting instruction address: 0xc0021f0c
  Oops: Kernel access of bad area, sig: 11 [#1]
  BE PAGE_SIZE=4K PREEMPT CMPCPRO
  SAF3000 DIE NOTIFICATION
  CPU: 0 PID: 442 Comm: null_syscall Not tainted 5.13.0-rc6-s3k-dev-01645-g7649ee3d2957 #5164
  NIP:  c0021f0c LR: c00e8ad8 CTR: c00d8a5c
  NIP perf_instruction_pointer+0x10/0x60
  LR  perf_prepare_sample+0x344/0x674
  Call Trace:
    perf_prepare_sample+0x7c/0x674 (unreliable)
    perf_event_output_forward+0x3c/0x94
    __perf_event_overflow+0x74/0x14c
    perf_swevent_hrtimer+0xf8/0x170
    __hrtimer_run_queues.constprop.0+0x160/0x318
    hrtimer_interrupt+0x148/0x3b0
    timer_interrupt+0xc4/0x22c
    Decrementer_virt+0xb8/0xbc

During perf record session, perf_instruction_pointer() is called to
capture the sample IP. This function in core-book3s accesses
ppmu->flags. If a platform specific PMU driver is not registered, ppmu
is set to NULL and accessing its members results in a crash. Fix this
crash by checking if ppmu is set.

Fixes: 2ca13a4cc56c ("powerpc/perf: Use regs->nip when SIAR is zero")
Cc: stable@vger.kernel.org # v5.11+
Reported-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Tested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1623952506-1431-1-git-send-email-atrajeev@linux.vnet.ibm.com
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: core-book3s.c
change_type: ModificationType.MODIFY
diff: @@ -2254,7 +2254,7 @@ unsigned long perf_instruction_pointer(struct pt_regs *regs)
 	bool use_siar = regs_use_siar(regs);
 	unsigned long siar = mfspr(SPRN_SIAR);
 
-	if (ppmu->flags & PPMU_P10_DD1) {
+	if (ppmu && (ppmu->flags & PPMU_P10_DD1)) {
 		if (siar)
 			return siar;
 		else

programming_language: C
CVE-2017-2602 (published 2018-05-15T21:29Z)

jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/jenkinsci/jenkins
commit_details: repo_url: https://github.com/jenkinsci/jenkins
author: Jesse Glick
author_date: 2017-01-10 17:26:00-05:00
msg: Merge pull request #89 from jenkinsci-cert/SECURITY-358

[SECURITY-358] Restrict access to metadata used by WorkflowRun
repository: repo_url: https://github.com/jenkinsci/jenkins
repo_name: jenkinsci/jenkins
description: Jenkins automation server
repo_language: Java
owner: jenkinsci
CVE-2024-34073 (published 2024-05-03T11:15Z)

sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. In affected versions the capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils` module allows for potentially unsafe Operating System (OS) Command Injection if inappropriate command is passed as the “requirements_path” parameter. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. This issue has been addressed in version 2.214.3. Users are advised to upgrade. Users unable to upgrade should not override the “requirements_path” parameter of capture_dependencies function in `sagemaker.serve.save_retrive.version_1_0_0.save.utils`, and instead use the default value.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/aws/sagemaker-python-sdk
commit_details: repo_url: https://github.com/aws/sagemaker-python-sdk
author: jiapinw
author_date: 2024-04-02 14:50:01-07:00
msg: [Fix] Switch to subprocess in ModelBuilder when capturing dependencies (#4556)

* [Fix] Switch to subprogress in ModelBuilder when capturing dependencies

* Fix style issues and explicitly set check to true
repository: repo_url: https://github.com/aws/sagemaker-python-sdk
repo_name: aws/sagemaker-python-sdk
description: A library for training and deploying machine learning models on Amazon SageMaker
repo_language: Python
owner: aws
file_changes: filename: utils.py
change_type: ModificationType.MODIFY
diff: @@ -5,6 +5,7 @@ import hmac
 import hashlib
 import os
 import logging
+import subprocess
 import sys
 import platform
 from collections import defaultdict
@@ -98,10 +99,10 @@ def capture_dependencies(requirements_path: str):
             f.write(sagemaker_dependency)
         return
 
-    command = f"pigar gen -f {Path(requirements_path)} {os.getcwd()}"
-    logging.info("Running command %s", command)
+    command = ["pigar", "gen", "-f", str(Path(requirements_path)), str(os.getcwd())]
+    logging.info("Running command: %s", " ".join(command))
 
-    os.system(command)
+    subprocess.run(command, check=True, capture_output=True)
     logger.info("Dependencies captured successfully")
 
 

programming_language: Python