MGASA-2024-0228 - Updated python-scikit-learn packages fix security vulnerability

Publication date: 20 Jun 2024
URL: https://advisories.mageia.org/MGASA-2024-0228.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2024-5206

A sensitive data leakage vulnerability was identified in scikit-learn's
TfidfVectorizer, specifically in versions up to and including
1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises
from the unexpected storage of all tokens present in the training data
within the `stop_words_` attribute, rather than only storing the subset
of tokens required for the TF-IDF technique to function. This behavior
leads to the potential leakage of sensitive information, as the
`stop_words_` attribute could contain tokens that were meant to be
discarded and not stored, such as passwords or keys. The impact of this
vulnerability varies based on the nature of the data being processed by
the vectorizer.

References:
- https://bugs.mageia.org/show_bug.cgi?id=33307
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/RRNRD64XAZJHFLB6MHKCGUBBVTIA3E7V/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5206

SRPMS:
- 9/core/python-scikit-learn-1.1.2-2.1.mga9