BIT-MLFLOW-2024-37056

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with...

scikit-learn sensitive data leakage vulnerability

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stopwords...

GHSA-JW8X-6495-233V scikit-learn sensitive data leakage vulnerability

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stopwords...

iepy (0.9.5), revscoring (>=0.6.4, <=0.7.11) +1 more potentially affected by CVE-2024-5206 via scikit-learn (0.15.2)

scikit-learn PYPI version 0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - iepy 0.9.5 - revscoring =0.6.4, =0.7.11 - skll 1.0.0 Source cves: CVE-2024-5206 Source advisory: OSV:GHSA-JW8X-6495-233V...

skll (1.1.0) potentially affected by CVE-2024-5206 via scikit-learn (0.16.1)

scikit-learn PYPI version 0.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - skll 1.1.0 Source cves: CVE-2024-5206 Source advisory: OSV:GHSA-JW8X-6495-233V...

fukuml (>=0.1.5, <=0.4.1), moodleinspire (0.0.10) +6 more potentially affected by CVE-2024-5206 via scikit-learn (0.17.1)

scikit-learn PYPI version 0.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - fukuml =0.1.5, =0.0.2, =0.0.1, =1.0.1, =0.0.4.dev41, =1.2.0, =0.3.0, =0.3.2 Source cves: CVE-2024-5206 Source advisory:...

jupyter-utils (1.2.4) potentially affected by CVE-2024-5206 via scikit-learn (0.18.0)

scikit-learn PYPI version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - jupyter-utils 1.2.4 Source cves: CVE-2024-5206 Source advisory: OSV:GHSA-JW8X-6495-233V...

chicksexer (0.2.2), example-jpromero-2017 (>=0.0.1, <=0.1.3) +11 more potentially affected by CVE-2024-5206 via scikit-learn (0.18.1)

scikit-learn PYPI version 0.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - chicksexer 0.2.2 - example-jpromero-2017 =0.0.1, =0.1.3, =0.0.3, =0.0.1, =1.0.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2024-5206 Sour...

auto-dl (0.1.1), auto-ml (>=2.8.0, <=2.8.1) +42 more potentially affected by CVE-2024-5206 via scikit-learn (0.19.1)

scikit-learn PYPI version 0.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - auto-dl 0.1.1 - auto-ml =2.8.0, =1.0.72, =0.1.57, =0.1.19008.12a1, =0.2.0, =0.10.0, =1.1.5, =0.0.12, =0.0.6b0, =0.0.5, =0.2.0, =0.4.0 -...

articlequality (0.4.1), bdacore (3.0.1) +37 more potentially affected by CVE-2024-5206 via scikit-learn (0.19.2)

scikit-learn PYPI version 0.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - articlequality 0.4.1 - bdacore 3.0.1 - codedomainemissary 0.0.1.dev0 - ctparse =0.0.16, =0.1.0, =2.0.0.dev1, =0.6.5, =0.0.1, =0.3.0,...

clinica (>=0.2.0b1, <=0.2.1), graphkit-learn (0.1.0) +7 more potentially affected by CVE-2024-5206 via scikit-learn (0.20.0)

scikit-learn PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - clinica =0.2.0b1, =0.1.1, =0.1.4, =0.1.2.2, =0.1.2.3 Source cves: CVE-2024-5206 Source advisory: OSV:GHSA-JW8X-6495-233V...

alibaba-suanfa (1.0.0), berryworld (>=1.0.0.40992, <=1.0.0.120361) +16 more potentially affected by CVE-2024-5206 via scikit-learn (0.20.2)

scikit-learn PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - alibaba-suanfa 1.0.0 - berryworld =1.0.0.40992, =0.5.7, =0.0.1.0, =0.2.3.1, =0.5.1, =0.5.3, =0.5.4 - novosparc 0.3.0 - profanity-check...

articlequality (0.4.2), azureml-automl-core (>=1.0.39, <=1.0.74) +30 more potentially affected by CVE-2024-5206 via scikit-learn (0.20.3)

scikit-learn PYPI version 0.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - articlequality 0.4.2 - azureml-automl-core =1.0.39, =1.0.76, =0.0.112, =1.0.21, =1.0.76, =2020.2.22a0, =0.6.4, =0.5.0rc0, =0.0.5,...

b2btools (>=3.0.0b34, <=3.0.0), bxtorch (>=0.2.17, <=0.6.0) +42 more potentially affected by CVE-2024-5206 via scikit-learn (0.20.4)

scikit-learn PYPI version 0.20.4 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - b2btools =3.0.0b34, =0.2.17, =0.0.4, =1.4.8, =0.1.1, =0.0.36, =0.6.0, =0.5.1, =0.7.0, =0.0.4, =0.6.1, =0.4.11, =0.0.1, =0.1.0 -...

back (>=0.1.1, <=0.1.4), mogp (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2024-5206 via scikit-learn (0.21.1)

scikit-learn PYPI version 0.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - back =0.1.1, =0.1.1, =0.1.2 - trackpal 1.2.0 Source cves: CVE-2024-5206 Source advisory: OSV:GHSA-JW8X-6495-233V...

autogluon (0.0.5), bliz (>=0.1.0, <=0.1.3) +25 more potentially affected by CVE-2024-5206 via scikit-learn (0.21.2)

scikit-learn PYPI version 0.21.2 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - autogluon 0.0.5 - bliz =0.1.0, =0.0.70, =0.1.18, =1.0.0, =0.8.0, =0.2.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.0.3, =0.0.14 and mo...

adpred (>=1.1.2, <=1.2.7), adversarial-labeller (>=0.1.2, <=0.1.7) +118 more potentially affected by CVE-2024-5206 via scikit-learn (0.21.3)

scikit-learn PYPI version 0.21.3 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - adpred =1.1.2, =0.1.2, =0.42.0, =0.3.0, =0.1.1, =1.0.81, =1.0.81, =1.0.0rc83, =0.3.0, =0.3.7 - bicleaner 0.12.0 and more Source cves:...

ailab-lite (>=0.1.1, <=0.1.14), argumentative-question-classifier (>=0.0.9, <=0.71.0) +81 more potentially affected by CVE-2024-5206 via scikit-learn (0.23.1)

scikit-learn PYPI version 0.23.1 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - ailab-lite =0.1.1, =0.0.9, =0.15.0, =1.0.0, =3.0.2, =0.0.1, =0.1.0.dev1, =0.0.1a39, =0.0.1a1, =1.2.0, =0.0.2.post3, =0.1.0, =0.2.3 -...

accutuning-helpers (>=1.0.32, <=1.1.0), adversarial-robustness-toolbox (>=1.3.3, <=1.6.0) +305 more potentially affected by CVE-2024-5206 via scikit-learn (0.23.2)

scikit-learn PYPI version 0.23.2 is affected by a known vulnerability. The following packages have a transitive dependency on scikit-learn and may be impacted: - accutuning-helpers =1.0.32, =1.3.3, =0.1.0.dev24560066971, =0.0.2, =0.1.0, =0.0.3, =0.50.0, =0.1.7, =1.1.16, =0.1.0, =0.0.3, =0.1.3,...

3deecelltracker (>=0.5.0a0, <=1.0.0), a2g (2020.0.1) +2436 more potentially affected by CVE-2024-5206 via scikit-learn (>=1.0.0, <=1.5.0rc1)

scikit-learn PYPI version =1.0.0, =0.5.0a0, =0.1.0, =0.3.2, =0.9.0.dev1, =25.9.23, =0.0.1b1, =4.2.1, =3.3.0.1, =3.6.20251218 and more Source cves: CVE-2024-5206 Source advisory: OSV:GHSA-JW8X-6495-233V...