There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in
    versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from
    the unexpected storage of all tokens present in the training data within the `stop_words_` attribute,
    rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior
    leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain
    tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this
    vulnerability varies based on the nature of the data being processed by the vectorizer. (CVE-2024-5206)

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 1.4.1.post1 (含) 之前的版本中特別是在 scikit-learn 的 TfidfVectorizer 中發現一個敏感資料洩漏弱點此問題已在版本 1.5.0中修正。此弱點是因為 `stop_words_` 屬性內非預期儲存訓練資料中存在的所有 token 而不是只儲存 TF-IDF 技術運作所需的 token 子集所致。此行為可能會導致敏感資訊洩漏因為 `stop_words_` 屬性可能包含本應捨棄但未儲存的 token (例如密碼或金鑰)。此弱點的影響會根據向量化程式所處理資料的性質而有所不同。 (CVE-2024-5206)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 scikit-learn 的 TfidfVectorizer 中发现一个敏感数据泄露漏洞尤其是 1.4.1.post1 及之前版本已在 1.5.0版本中修复。导致该漏洞的原因是在“stop_words_”属性内意外存储了培训数据中存在的所有标记而不是只存储 TF-IDF 技术正常运行所需的标记子集。此行为可能导致敏感信息泄漏因为“stop_words_”属性可能包含密码或密钥等应被丢弃而非存储的标记。此漏洞的影响因矢量化器所处理数据的性质而异。 (CVE-2024-5206)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - sckit-learn の TfidfVectorizer、特に 1.4.1.post1 までのバージョンで、機密データ漏洩の脆弱性が見つかりました。これは、バージョン 1.5.0で修正されました。脆弱性は、TF-IDF手法が機能するために必要なトークンのサブセットのみを保存するのではなく、「stop_words_」属性内のトレーニングデータに存在するすべてのトークンの予期しない保存から発生します。この動作により、機密情報が漏洩する可能性があります。これは、「stop_words_」属性が、パスワードやキーなど、破棄され保存されないことが意図されていたトークンを含んでいる可能性があるためです。この脆弱性の影響は、ベクトルライザーによって処理されるデータの性質によって異なります。CVE-2024-5206

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

リモートの SUSE Linux SLES15 / openSUSE 15 ホストには、SUSE-SU-2024:2029-1 のアドバイザリに記載されている脆弱性の影響を受けるパッケージがインストールされています。

    -CVE-2024-5206: TfidfVectorizer で機密データが漏洩する可能性がある問題を修正しました。(bsc#1226185)

Tenable は、前述の記述ブロックを SUSE セキュリティアドバイザリから直接抽出しています。

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0487 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-5206:
    A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in     versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from     the unexpected storage of all tokens present in the training data within the `stop_words_` attribute,     rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior     leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain     tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this     vulnerability varies based on the nature of the data being processed by the vectorizer.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2029-1 advisory.

    -CVE-2024-5206: Fixed a possible sensitive data leak in TfidfVectorizer. (bsc#1226185)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A sensitive data leakage vulnerability was identified in scikit-learn's TfidfVectorizer, specifically in     versions up to and including 1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises from     the unexpected storage of all tokens present in the training data within the `stop_words_` attribute,     rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior     leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain     tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this     vulnerability varies based on the nature of the data being processed by the vectorizer. (CVE-2024-5206)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
421384	SCA: security update for scikit-learn (GHSA-jw8x-6495-233v)	Tenable Cloud Security	SCA Checks	2025/3/28	2026/7/2	medium
421384	SCA: security update for scikit-learn (GHSA-jw8x-6495-233v)	Tenable Self-Hosted Container Security	SCA Checks	2025/3/28	2026/7/2	medium
257393	Linux Distros 未修補的弱點：CVE-2024-5206	Nessus	Misc.	2025/8/27	2026/7/9	medium
257393	Linux Distros 未修补的漏洞：CVE-2024-5206	Nessus	Misc.	2025/8/27	2026/7/9	medium
257393	Linux Distros のパッチ未適用の脆弱性: CVE-2024-5206	Nessus	Misc.	2025/8/27	2026/7/9	medium
200514	SUSE SLES15 / openSUSE 15 セキュリティ更新 : python-scikit-learn (SUSE-SU-2024:2029-1)	Nessus	SuSE Local Security Checks	2024/6/14	2024/10/25	medium
238515	TencentOS Server 4: python-scikit-learn (TSSA-2024:0487)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	medium
200514	SUSE SLES15 / openSUSE 15 Security Update : python-scikit-learn (SUSE-SU-2024:2029-1)	Nessus	SuSE Local Security Checks	2024/6/14	2024/10/25	medium
257393	Linux Distros Unpatched Vulnerability : CVE-2024-5206	Nessus	Misc.	2025/8/27	2026/7/9	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium