{"id":"MGASA-2024-0228","summary":"Updated python-scikit-learn packages fix security vulnerability","details":"A sensitive data leakage vulnerability was identified in scikit-learn's\nTfidfVectorizer, specifically in versions up to and including\n1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises\nfrom the unexpected storage of all tokens present in the training data\nwithin the `stop_words_` attribute, rather than only storing the subset\nof tokens required for the TF-IDF technique to function. This behavior\nleads to the potential leakage of sensitive information, as the\n`stop_words_` attribute could contain tokens that were meant to be\ndiscarded and not stored, such as passwords or keys. The impact of this\nvulnerability varies based on the nature of the data being processed by\nthe vectorizer.\n","modified":"2026-04-16T04:43:40.879965039Z","published":"2024-06-20T02:32:09Z","upstream":["CVE-2024-5206"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2024-0228.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=33307"},{"type":"WEB","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/RRNRD64XAZJHFLB6MHKCGUBBVTIA3E7V/"}],"affected":[{"package":{"name":"python-scikit-learn","ecosystem":"Mageia:9","purl":"pkg:rpm/mageia/python-scikit-learn?arch=source&distro=mageia-9"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-2.1.mga9"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2024-0228.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}