Patch PyTorch 2.7 sagemaker package (#4976)

* Patch PyTorch 2.7 sagemaker package

* buisl test pt 2.7

* fix core packages

* pin sagemaker-training

* specify pt 2.7

* fix elif

* pin pytorch training toolkit

* add py allowlist

Author: sirutBuasai

miscellaneous_scripts/dockerfile_patch_script.sh

@@ -55,6 +55,8 @@ fi
 # Upgrade sagemaker-training
 if [[ $LATEST_RELEASED_IMAGE_URI =~ ^763104351884\.dkr\.ecr\.us-west-2\.amazonaws\.com/pytorch-training:2\.[4-6](.+)sagemaker ]]; then
     pip install -U "sagemaker-training>4.7.4" "protobuf>=4.25.8,<6"
+elif [[ $LATEST_RELEASED_IMAGE_URI =~ ^763104351884\.dkr\.ecr\.us-west-2\.amazonaws\.com/pytorch-training:2\.7(.+)sagemaker ]]; then
+    pip install -U "sagemaker-training>4.7.4,<5" "sagemaker-pytorch-training>=2.9.0"
 fi
 
 # For PT inference gpu sagemaker images, replace start_cuda_compat.sh

pytorch/training/docker/2.7/py3/Dockerfile.sagemaker.cpu.core_packages.json

@@ -45,7 +45,7 @@
     "version_specifier": "<1"
   },
   "sagemaker-training": {
-    "version_specifier": "<=4.8.3"
+    "version_specifier": ">=4.8.3"
   },
   "tqdm": {
     "version_specifier": ">=4.66.3"

pytorch/training/docker/2.7/py3/Dockerfile.sagemaker.cpu.py_scan_allowlist.json

@@ -0,0 +1,3 @@
+{
+  "77740": "Package: protobuf is required by sagemaker-training-toolkit. Advisory: Affected versions of this package are vulnerable to a potential Denial of Service (DoS) attack due to unbounded recursion when parsing untrusted Protocol Buffers data. The pure-Python implementation fails to enforce recursion depth limits when processing recursive groups, recursive messages, or a series of SGROUP tags, leading to stack overflow conditions that can crash the application by exceeding Python's recursion limit."
+}

pytorch/training/docker/2.7/py3/cu128/Dockerfile.sagemaker.gpu.core_packages.json

@@ -46,7 +46,7 @@
     "version_specifier": ">=6.5.1"
   },
    "sagemaker-training": {
-    "version_specifier": "<=4.8.3"
+    "version_specifier": ">=4.8.3"
   },
    "sagemaker": {
     "version_specifier": ">=2,<3"

pytorch/training/docker/2.7/py3/cu128/Dockerfile.sagemaker.gpu.py_scan_allowlist.json

@@ -0,0 +1,3 @@
+{
+  "77740": "Package: protobuf is required by sagemaker-training-toolkit. Advisory: Affected versions of this package are vulnerable to a potential Denial of Service (DoS) attack due to unbounded recursion when parsing untrusted Protocol Buffers data. The pure-Python implementation fails to enforce recursion depth limits when processing recursive groups, recursive messages, or a series of SGROUP tags, leading to stack overflow conditions that can crash the application by exceeding Python's recursion limit."
+}