Updated python-scikit-learn packages fix security vulnerability

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stopwords...

Mageia: Security Advisory (MGASA-2024-0228)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2024:14043-1 python310-scikit-learn-1.5.0-1.1 on GA media

These are all security issues fixed in the python310-scikit-learn-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE SLES15 / openSUSE 15 Security Update : python-scikit-learn (SUSE-SU-2024:2029-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2029-1 advisory. -CVE-2024-5206: Fixed a possible sensitive data leak in TfidfVectorizer. bsc1226185 Tenable has extracted the preceding description block...

SUSE-SU-2024:2029-1 Security update for python-scikit-learn

This update for python-scikit-learn fixes the following issues: -CVE-2024-5206: Fixed a possible sensitive data leak in TfidfVectorizer. bsc1226185...

Improper Access Control

scikit-learn is vulnerable to Improper Access Control. The vulnerability is due to the unexpected storage of all tokens in the stopwords attribute, which can leak sensitive information such as passwords or keys when using the TfidfVectorizer class...

SUSE CVE-2024-5206

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stopwords...

CVE-2024-5206

A vulnerability was found in the scikit-learn package. Before version 1.4.1, post1 scikit-learn stores all tokens with "stopwords" attributes. This action may cause scikit-learn to expose sensitive data that will not be used in the model training, possibly leaking passwords and keys...

BIT-MLFLOW-2024-37052

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

BIT-MLFLOW-2024-37053

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with...

BIT-MLFLOW-2024-37056

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with...

learn-quality.com Cross Site Scripting vulnerability OBB-3933407

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

alphawaves (0.1.0), clinica (>=0.3.8rc1, <=0.5.2) +18 more potentially affected by CVE-2024-5206 via scikit-learn (0.23.0)

scikit-learn PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - alphawaves 0.1.0 - clinica =0.3.8rc1, =1.0.0, =0.1.1, =0.0.1, =0.1.21.29, =0.23.0.0, =0.1.0, =0.3.0, =1.3.1, =0.0.3, =0.4.0, =0.6.1 and...

addr-detector (0.1.0), deeppavlov (>=0.0.5.1, <=0.0.5.3) +6 more potentially affected by CVE-2024-5206 via scikit-learn (0.19.0)

scikit-learn PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - addr-detector 0.1.0 - deeppavlov =0.0.5.1, =0.1.2, =1.0.1, =1.0.2 Source cves: CVE-2024-5206 Source advisory: OSV:GHSA-JW8X-6495-233V...

accutuning-helpers (>=1.0.32, <=1.1.0), adversarial-robustness-toolbox (>=1.3.3, <=1.6.0) +305 more potentially affected by CVE-2024-5206 via scikit-learn (0.23.2)

scikit-learn PYPI version 0.23.2 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - accutuning-helpers =1.0.32, =1.3.3, =0.1.0.dev24560066971, =0.0.2, =0.1.0, =0.0.3, =0.50.0, =0.1.7, =1.1.16, =0.1.0, =0.0.3, =0.1.3,...

skll (1.1.0) potentially affected by CVE-2024-5206 via scikit-learn (0.16.1)

scikit-learn PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - skll 1.1.0 Source cves: CVE-2024-5206 Source advisory: OSV:GHSA-JW8X-6495-233V...

scikit-learn sensitive data leakage vulnerability

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stopwords...

adversarial-robustness-toolbox (1.6.1), aiqc (>=2.1.0, <=7.1.5) +120 more potentially affected by CVE-2024-5206 via scikit-learn (0.24.1)

scikit-learn PYPI version 0.24.1 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - adversarial-robustness-toolbox 1.6.1 - aiqc =2.1.0, =0.7.0, =2.0.0, =0.0.37, =0.0.1, =0.1.0, =2021.3.29.16, =0.2.4, =0.1.0, =0.0.396,...

audiolm-pytorch (>=1.1.5, <=1.2.12), autoforecast (>=0.0.6, <=0.0.9) +31 more potentially affected by CVE-2024-5206 via scikit-learn (0.24.0)

scikit-learn PYPI version 0.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - audiolm-pytorch =1.1.5, =0.0.6, =1.0.1, =0.2.1, =0.0.2, =0.0.6, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.38.0 and more Source cves:...

adversarial-robustness-toolbox (>=1.2.0, <=1.3.2), alectiolite (0.0.1) +55 more potentially affected by CVE-2024-5206 via scikit-learn (0.22.1)

scikit-learn PYPI version 0.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - adversarial-robustness-toolbox =1.2.0, =1.2.0, =0.13.0, =0.0.1, =0.0.4, =0.2.0rc0, =0.0.4, =0.1.3, =1.0.11, =1.1.0 - dostoevsky 0.5.0 a...