PT-2024-6156 · Nltk+2 · Nltk+2

Smartkeyss · Published 2024-05-19 · Updated 2024-11-28 · CVE-2024-39705

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NLTK versions 3.8.1 and earlier

Description The issue is related to the nltk.download() function in the NLTK library, which can lead to remote code execution when untrusted packages containing pickled Python code are downloaded. This particularly affects the averaged perceptron tagger and punkt packages. The exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations For NLTK versions 3.8.1 and earlier, as a temporary workaround, consider disabling the integrated data package download functionality until a patch is available. Restrict access to untrusted packages to minimize the risk of exploitation. Avoid using the nltk.download() function for packages that may contain pickled Python code until the issue is resolved.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-300

Related Identifiers

ALT-PU-2024-15950

ALT-PU-2024-16034

ALT-PU-2024-16208

BDU:2024-07075

CVE-2024-39705

GHSA-CGVX-9447-VCCH

OPENSUSE-SU-2024:0221-1

OPENSUSE-SU-2024:0222-1

OPENSUSE-SU-2024:14103-1

PYSEC-2024-167

Affected Products

Alt Linux

Debian

Nltk

References · 27

• https://osv.dev/vulnerability/openSUSE-SU-2024:14103-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgvx-9447-vcch · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-39705 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07075 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-39705 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-39705 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:0222-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-39705 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0221-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-39705 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-39705 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-167 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39705 · Vendor Advisory
• https://github.com/nltk/nltk · Note
• https://github.com/nltk/nltk/issues/3266 · Note