A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in     versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from     the unexpected storage of all tokens present in the training data within the `stop_words_` attribute,     rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior     leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain     tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this     vulnerability varies based on the nature of the data being processed by the vectorizer. (CVE-2024-5206)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0487 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-5206:
    A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in     versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from     the unexpected storage of all tokens present in the training data within the `stop_words_` attribute,     rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior     leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain     tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this     vulnerability varies based on the nature of the data being processed by the vectorizer.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in
    versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from
    the unexpected storage of all tokens present in the training data within the `stop_words_` attribute,
    rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior
    leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain
    tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this
    vulnerability varies based on the nature of the data being processed by the vectorizer. (CVE-2024-5206)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2029-1 advisory.

    -CVE-2024-5206: Fixed a possible sensitive data leak in TfidfVectorizer. (bsc#1226185)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
257393	Linux Distros Unpatched Vulnerability : CVE-2024-5206	Nessus	Misc.	Local	medium
238515	TencentOS Server 4: python-scikit-learn (TSSA-2024:0487)	Nessus	Tencent Local Security Checks	Local	medium
421384	SCA: security update for scikit-learn (GHSA-jw8x-6495-233v)	Tenable Cloud Security	SCA Checks	Local	medium
421384	SCA: security update for scikit-learn (GHSA-jw8x-6495-233v)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
200514	SUSE SLES15 / openSUSE 15 Security Update : python-scikit-learn (SUSE-SU-2024:2029-1)	Nessus	SuSE Local Security Checks	Local	medium

Detections

Analytics

CVE-2024-5206

medium

Tenable Plugins

medium

medium

medium

medium

medium