scikit-learn sensitive data leakage vulnerability
A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the stop_words_ attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the stop_words_ attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | scikit-learn | < 1.5.0 | 1.5.0 |
Referencias
- https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517c
- https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8
- https://github.com/advisories/GHSA-jw8x-6495-233v
- https://nvd.nist.gov/vuln/detail/CVE-2024-5206
- https://github.com/pypa/advisory-database/tree/main/vulns/scikit-learn/PYSEC-2024-110.yaml
- https://github.com/scikit-learn/scikit-learn
- Vector CVSS
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N- Debilidad (CWE)
CWE-921, CWE-922- Plataforma
- Python (PyPI)
- Paquete
scikit-learn- Publicada
- 06.06.2024
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2024-110 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-jw8x-6495-233v - CC BY 4.0
Historial de vulnerabilidades: scikit-learn
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 3
- Primera → última
- 05.2020 06.2024
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 1
- Media 1
Divulgaciones por año
- 2020: 2
- 2021: 0
- 2022: 0
- 2023: 0
- 2024: 1
- 2025: 0
- 2026: 0
-
scikit-learn sensitive data leakage vulnerability esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.