Updated python-scikit-learn packages fix security vulnerability
Publication date: 20 Jun 2024Modification date: 20 Jun 2024
Type: security
Affected Mageia releases : 9
CVE: CVE-2024-5206
Description
A sensitive data leakage vulnerability was identified in scikit-learn's
TfidfVectorizer, specifically in versions up to and including
1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises
from the unexpected storage of all tokens present in the training data
within the `stop_words_` attribute, rather than only storing the subset
of tokens required for the TF-IDF technique to function. This behavior
leads to the potential leakage of sensitive information, as the
`stop_words_` attribute could contain tokens that were meant to be
discarded and not stored, such as passwords or keys. The impact of this
vulnerability varies based on the nature of the data being processed by
the vectorizer.
References
SRPMS
9/core
- python-scikit-learn-1.1.2-2.1.mga9