GitHub Advisoryadvisory · PyPI

GHSA-jjw5-xxj6-pcv5 scikit-learn Deserialization of Untrusted Data

CRITICAL Published 2022-05-24 Modified 2024-10-22 Official page ↗
Aliases
CVE-2020-13092
Ecosystem
PyPI
Packages
scikit-learn
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2024-04-22

Affected packages

• PyPI scikit-learn: <= 0.23.0 (no fix yet)

Description

scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the `joblib.load()` function, if `__reduce__` makes an `os.system call`. NOTE: third parties dispute this issue because the joblib.load() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner.

Related

Alias · CVE (1)

  • CVE-2020-13092 scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load()… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References