Skip to content

Conversation

fixleftdev
Copy link
Owner

Lineaje has automatically created this pull request to resolve the following CVEs:

CVE ID Severity Description
CVE-2024-5206 Medium A sensitive data leakage vulnerability was identified in scikit-learn's
TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which
was fixed in version 1.5.0. The vulnerability arises from the unexpected storage
of all tokens present in the training data within the stop_words_ attribute,
rather than only storing the subset of tokens required for the TF-IDF technique
to function. This behavior leads to the potential leakage of sensitive
information, as the stop_words_ attribute could contain tokens that were meant
to be discarded and not stored, such as passwords or keys. The impact of this
vulnerability varies based on the nature of the data being processed by the
vectorizer.
CVE-2020-28975 High svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn 0.23.2 and
other products, allows attackers to cause a denial of service (segmentation
fault) via a crafted model SVM (introduced via pickle, json, or any other model
permanence standard) with a large value in the _n_support array. NOTE: the
scikit-learn vendor's position is that the behavior can only occur if the
library's API is violated by an application that changes a private attribute.

You can merge this PR once the tests pass and the changes are reviewed.

Thank you for reviewing the update! 🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant