PYSEC-2020-107

2020-05-1519:15:00

Google

osv.dev

0.01 Low

EPSS

Percentile

83.7%

JSON

DISPUTED scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the joblib.load() function is documented as unsafe and it is the user’s responsibility to use the function in a secure manner.

CPENameOperatorVersion
scikit-learneq0.12
scikit-learneq0.21rc2
scikit-learneq0.23.0
scikit-learneq0.16b1
scikit-learneq0.20.1
scikit-learneq0.20.3
scikit-learneq0.22.2
scikit-learneq0.19.1
scikit-learneq0.19.2
scikit-learneq0.10

Name	Operator	Version
scikit-learn	eq	0.12
scikit-learn	eq	0.21rc2
scikit-learn	eq	0.23.0
scikit-learn	eq	0.16b1
scikit-learn	eq	0.20.1
scikit-learn	eq	0.20.3
scikit-learn	eq	0.22.2
scikit-learn	eq	0.19.1
scikit-learn	eq	0.19.2
scikit-learn	eq	0.10