Mageia: Security Advisory (MGASA-2024-0228)

# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.1.10.2024.0228");
  script_cve_id("CVE-2024-5206");
  script_tag(name:"creation_date", value:"2024-06-20 04:11:13 +0000 (Thu, 20 Jun 2024)");
  script_version("2024-06-20T05:05:33+0000");
  script_tag(name:"last_modification", value:"2024-06-20 05:05:33 +0000 (Thu, 20 Jun 2024)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:N/A:N");

  script_name("Mageia: Security Advisory (MGASA-2024-0228)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2024 Greenbone AG");
  script_family("Mageia Linux Local Security Checks");
  script_dependencies("gather-package-list.nasl");
  script_mandatory_keys("ssh/login/mageia_linux", "ssh/login/release", re:"ssh/login/release=MAGEIA9");

  script_xref(name:"Advisory-ID", value:"MGASA-2024-0228");
  script_xref(name:"URL", value:"https://advisories.mageia.org/MGASA-2024-0228.html");
  script_xref(name:"URL", value:"https://bugs.mageia.org/show_bug.cgi?id=33307");
  script_xref(name:"URL", value:"https://lists.opensuse.org/archives/list/[email protected]/message/RRNRD64XAZJHFLB6MHKCGUBBVTIA3E7V/");

  script_tag(name:"summary", value:"The remote host is missing an update for the 'python-scikit-learn' package(s) announced via the MGASA-2024-0228 advisory.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable package version is present on the target host.");

  script_tag(name:"insight", value:"A sensitive data leakage vulnerability was identified in scikit-learn's
TfidfVectorizer, specifically in versions up to and including
1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises
from the unexpected storage of all tokens present in the training data
within the `stop_words_` attribute, rather than only storing the subset
of tokens required for the TF-IDF technique to function. This behavior
leads to the potential leakage of sensitive information, as the
`stop_words_` attribute could contain tokens that were meant to be
discarded and not stored, such as passwords or keys. The impact of this
vulnerability varies based on the nature of the data being processed by
the vectorizer.");

  script_tag(name:"affected", value:"'python-scikit-learn' package(s) on Mageia 9.");

  script_tag(name:"solution", value:"Please install the updated package(s).");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"package");

  exit(0);
}

include("revisions-lib.inc");
include("pkg-lib-rpm.inc");

release = rpm_get_ssh_release();
if(!release)
  exit(0);

res = "";
report = "";

if(release == "MAGEIA9") {

  if(!isnull(res = isrpmvuln(pkg:"python-scikit-learn", rpm:"python-scikit-learn~1.1.2~2.1.mga9", rls:"MAGEIA9"))) {
    report += res;
  }

  if(!isnull(res = isrpmvuln(pkg:"python3-scikit-learn", rpm:"python3-scikit-learn~1.1.2~2.1.mga9", rls:"MAGEIA9"))) {
    report += res;
  }

  if(report != "") {
    security_message(data:report);
  } else if(__pkg_match) {
    exit(99);
  }
  exit(0);
}

exit(0);