Каталог CVE

CVE-2024-5206

scikit-learn affected and fixed versions

[Каталог CVE]

A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.

Критичність
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.19% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Opensusetumbleweedpython-scikit-learn1.5.0-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:14043-1]
Opensusetumbleweedpython-scikit-learn1.9.0-1.1UnknownSource applicability is not established[OPENSUSE-SU-2026:11498-1]
Debiantrixiescikit-learnNot reportedAffectedDistribution reports no fix[CVE-2024-5206]
Debiantrixiescikit-learn1.4.2+dfsg-8Affected[CVE-2024-5206]
Debiansidscikit-learnNot reportedAffectedDistribution reports no fix[CVE-2024-5206]
Debiansidscikit-learn1.9.0+dfsg-2Affected[CVE-2024-5206]
Suselinux enterprise module for package hub 15 sp6python-scikit-learn0.23.2-150300.3.3.1UnknownSource applicability is not established[SUSE-SU-2024:2029-1]
Suselinux enterprise module for package hub 15 sp5python-scikit-learn0.23.2-150300.3.3.1UnknownSource applicability is not established[SUSE-SU-2024:2029-1]
Opensuseleap 15.6python-scikit-learn0.23.2-150300.3.3.1UnknownSource applicability is not established[SUSE-SU-2024:2029-1]
Opensuseleap 15.5python-scikit-learn0.23.2-150300.3.3.1UnknownSource applicability is not established[SUSE-SU-2024:2029-1]
Debianforkyscikit-learnNot reportedAffectedDistribution reports no fix[CVE-2024-5206]
Debianforkyscikit-learn1.9.0+dfsg-2Affected[CVE-2024-5206]

Showing 12 observations. All 15 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedscikit-learnNot reportedUnknownSource applicability is not establishedProvider not reported
Debianbookwormscikit-learnNot reportedAffectedDistribution reports no fix[CVE-2024-5206]
Debianbookwormscikit-learn1.2.1+dfsg-1Affected[CVE-2024-5206]
Debianforkyscikit-learnNot reportedAffectedDistribution reports no fix[CVE-2024-5206]
Debianforkyscikit-learn1.9.0+dfsg-2Affected[CVE-2024-5206]
Debiansidscikit-learnNot reportedAffectedDistribution reports no fix[CVE-2024-5206]
Debiansidscikit-learn1.9.0+dfsg-2Affected[CVE-2024-5206]
Debiantrixiescikit-learnNot reportedAffectedDistribution reports no fix[CVE-2024-5206]
Debiantrixiescikit-learn1.4.2+dfsg-8Affected[CVE-2024-5206]
Opensuseleap 15.5python-scikit-learn0.23.2-150300.3.3.1UnknownSource applicability is not established[SUSE-SU-2024:2029-1]
Opensuseleap 15.6python-scikit-learn0.23.2-150300.3.3.1UnknownSource applicability is not established[SUSE-SU-2024:2029-1]
Opensusetumbleweedpython-scikit-learn1.5.0-1.1UnknownSource applicability is not established[OPENSUSE-SU-2024:14043-1]
Opensusetumbleweedpython-scikit-learn1.9.0-1.1UnknownSource applicability is not established[OPENSUSE-SU-2026:11498-1]
Suselinux enterprise module for package hub 15 sp5python-scikit-learn0.23.2-150300.3.3.1UnknownSource applicability is not established[SUSE-SU-2024:2029-1]
Suselinux enterprise module for package hub 15 sp6python-scikit-learn0.23.2-150300.3.3.1UnknownSource applicability is not established[SUSE-SU-2024:2029-1]
Original provider fields
{
  "package_releases": [
    {
      "name": "scikit-learn",
      "status": "vulnerable",
      "release": "sid",
      "version": "1.9.0+dfsg-2"
    },
    {
      "name": "scikit-learn",
      "status": "vulnerable",
      "release": "forky",
      "version": "1.9.0+dfsg-2"
    },
    {
      "name": "scikit-learn",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1.4.2+dfsg-8"
    },
    {
      "name": "scikit-learn",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1.2.1+dfsg-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1074234,
      "name": "scikit-learn",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": 1074234,
      "name": "scikit-learn",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": 1074234,
      "name": "scikit-learn",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": 1074234,
      "name": "scikit-learn",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "scikit-learn",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "python-scikit-learn",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.0-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:11498-1",
      "fixed_version": "1.9.0-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:11498-1",
      "provider_updated_at": "2026-08-12T10:45:07.668905558Z",
      "applicability_unknown": true
    },
    {
      "name": "python-scikit-learn",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.2-150300.3.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for package hub 15 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2024:2029-1",
      "fixed_version": "0.23.2-150300.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2024:2029-1",
      "provider_updated_at": "2026-02-04T03:32:49.184434Z",
      "applicability_unknown": true
    },
    {
      "name": "python-scikit-learn",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.2-150300.3.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for package hub 15 sp6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2024:2029-1",
      "fixed_version": "0.23.2-150300.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2024:2029-1",
      "provider_updated_at": "2026-02-04T03:32:49.184434Z",
      "applicability_unknown": true
    },
    {
      "name": "python-scikit-learn",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.2-150300.3.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2024:2029-1",
      "fixed_version": "0.23.2-150300.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2024:2029-1",
      "provider_updated_at": "2026-02-04T03:32:49.184434Z",
      "applicability_unknown": true
    },
    {
      "name": "python-scikit-learn",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.23.2-150300.3.3.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2024:2029-1",
      "fixed_version": "0.23.2-150300.3.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2024:2029-1",
      "provider_updated_at": "2026-02-04T03:32:49.184434Z",
      "applicability_unknown": true
    },
    {
      "name": "python-scikit-learn",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.0-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:14043-1",
      "fixed_version": "1.5.0-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:14043-1",
      "provider_updated_at": "2026-02-04T03:11:08.377519Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1074234]

OpenFactory catalog packages

Зіставлення пакетів триває.

[Debian 12 (Bookworm)]

  • [python3-sklearn]Невідомо

    Пакет джерела: [scikit-learn]

    Подробиці (2)

    • 1.2.1+dfsg-1 · all · bookworm

      Уражена

      dsa · scikit-learn · debian · bookworm; dsa · scikit-learn · debian · 12

    • 1.2.1+dfsg-1 · all · bookworm

      Уражена

      dsa · scikit-learn · debian · bookworm; dsa · scikit-learn · debian · 12

  • [python3-sklearn-lib]Невідомо

    Пакет джерела: [scikit-learn]

    Подробиці (2)

    • 1.2.1+dfsg-1 · amd64 · bookworm

      Уражена

      dsa · scikit-learn · debian · bookworm; dsa · scikit-learn · debian · 12

    • 1.2.1+dfsg-1 · arm64 · bookworm

      Уражена

      dsa · scikit-learn · debian · bookworm; dsa · scikit-learn · debian · 12

  • [python-sklearn-doc]Невідомо

    Пакет джерела: [scikit-learn]

    Подробиці (2)

    • 1.2.1+dfsg-1 · all · bookworm

      Уражена

      dsa · scikit-learn · debian · bookworm; dsa · scikit-learn · debian · 12

    • 1.2.1+dfsg-1 · all · bookworm

      Уражена

      dsa · scikit-learn · debian · bookworm; dsa · scikit-learn · debian · 12

[Debian 13 (Trixie)]

  • [python3-sklearn]Невідомо

    Пакет джерела: [scikit-learn]

    Подробиці (2)

    • 1.4.2+dfsg-8 · all · trixie

      Уражена

      dsa · scikit-learn · debian · 13

    • 1.4.2+dfsg-8 · all · trixie

      Уражена

      dsa · scikit-learn · debian · 13

  • [python3-sklearn-lib]Невідомо

    Пакет джерела: [scikit-learn]

    Подробиці (2)

    • 1.4.2+dfsg-8 · amd64 · trixie

      Уражена

      dsa · scikit-learn · debian · 13

    • 1.4.2+dfsg-8 · arm64 · trixie

      Уражена

      dsa · scikit-learn · debian · 13

  • [python-sklearn-doc]Невідомо

    Пакет джерела: [scikit-learn]

    Подробиці (2)

    • 1.4.2+dfsg-8 · all · trixie

      Уражена

      dsa · scikit-learn · debian · 13

    • 1.4.2+dfsg-8 · all · trixie

      Уражена

      dsa · scikit-learn · debian · 13

[openSUSE Tumbleweed]

  • [python313-scikit-learn]Невідомо

    Пакет джерела: [python-scikit-learn]

    Подробиці (1)

    • 1.9.0-2.1 · x86_64 · tumbleweed

      Невідомо · Виправлена: 1.5.0-1.1, 1.9.0-1.1

      Version impact unknown

      dsa · python-scikit-learn · opensuse · tumbleweed

  • [python314-scikit-learn]Невідомо

    Пакет джерела: [python-scikit-learn]

    Подробиці (1)

    • 1.9.0-2.1 · x86_64 · tumbleweed

      Невідомо · Виправлена: 1.5.0-1.1, 1.9.0-1.1

      Version impact unknown

      dsa · python-scikit-learn · opensuse · tumbleweed

Спостережено:

Посилання

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]