Detections
Analytics

Echo: scikit-learn: security update to 1.4.2+dfsg-8+e1

medium Tenable Self-Hosted Container Security Plugin ID 462117

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in
 versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from
 the unexpected storage of all tokens present in the training data within the `stop_words_` attribute,
 rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior
 leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain
 tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this
 vulnerability varies based on the nature of the data being processed by the vectorizer. (CVE-2024-5206)

Solution

Update the scikit-learn library and its related packages to version 1.4.2+dfsg-8+e1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2024-5206

Plugin Details

Severity: Medium

ID: 462117

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

CVSS v2

Risk Factor: Low

Base Score: 3.8

Temporal Score: 2.8

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:N/A:N

CVSS Score Source: CVE-2024-5206

CVSS v3

Risk Factor: Medium

Base Score: 4.7

Temporal Score: 4.1

Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/29/2026

Vulnerability Publication Date: 6/6/2024

Reference Information

CVE: CVE-2024-5206