Detections
Analytics
SCA: security update for scikit-learn (GHSA-jw8x-6495-233v)
medium Tenable Self-Hosted Container Security Plugin ID 421384
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in
versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from
the unexpected storage of all tokens present in the training data within the `stop_words_` attribute,
rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior
leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain
tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this
vulnerability varies based on the nature of the data being processed by the vectorizer. (CVE-2024-5206)
See Also
Plugin Details
Severity: Medium
ID: 421384
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 3/28/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.51
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Low
Base Score: 3.8
Temporal Score: 2.8
Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:N/A:N
CVSS Score Source: CVE-2024-5206
CVSS v3
Risk Factor: Medium
Base Score: 4.7
Temporal Score: 4.1
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 6/6/2024
Vulnerability Publication Date: 6/6/2024
Reference Information
CVE: CVE-2024-5206