Safety CI > naturalis/sdmdl

master

5 months, 1 week ago

c7dba2f6

Merge pull request #608 from naturalis/copilot/fix-ci-cd-pipeline-issues Upgrade CI Python from 3.9

No dependencies with known security vulnerabilities.

copilot/fix-ci-cd-pipeline-issues

5 months, 1 week ago

5f256a6b

Upgrade CI Python from 3.9 to 3.12 to support modern package versions Python 3.9 is too old for pac

No dependencies with known security vulnerabilities.

pyup-update-shap-0.49.1-to-0.51.0

5 months, 1 week ago

6b17eb72

Update shap from 0.49.1 to 0.51.0

No dependencies with known security vulnerabilities.

master

5 months, 1 week ago

e7d98c1a

Update shap version from 0.51.0 to 0.49.1

No dependencies with known security vulnerabilities.

pyup-update-pandas-3.0.1-to-3.0.2

5 months, 1 week ago

c8e17023

Update pandas from 3.0.1 to 3.0.2

No dependencies with known security vulnerabilities.

master

5 months, 2 weeks ago

b1b9ed62

Merge pull request #597 from naturalis/copilot/migrate-travis-to-github-action Migrate Travis CI pi

No dependencies with known security vulnerabilities.

master

5 months, 2 weeks ago

7034ff63

Update package versions in requirements.txt Updated package versions in requirements.txt for compat

No dependencies with known security vulnerabilities.

pyup-update-fiona-1.10b2-to-1.10.1

5 months, 2 weeks ago

3974fc58

Update fiona from 1.10b2 to 1.10.1

rasterio 1.0.27 has known security vulnerabilities.

Package	Installed	Affected	Info
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'json-c' to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	>=1.0a1,<1.3.8.post1	show Rasterio 1.3.8.post1 updates its C dependency 'libwebp' to v1.3.2 to include a fix for a high-risk vulnerability. https://github.com/rasterio/rasterio/discussions/2924
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix.
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/112
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81

master

5 months, 2 weeks ago

6ccba3b9

Merge pull request #600 from naturalis/dependabot/pip/geopandas-1.1.2 Bump geopandas from 0.5.1 to

rasterio 1.0.27 has known security vulnerabilities.

Package	Installed	Affected	Info
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'json-c' to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	>=1.0a1,<1.3.8.post1	show Rasterio 1.3.8.post1 updates its C dependency 'libwebp' to v1.3.2 to include a fix for a high-risk vulnerability. https://github.com/rasterio/rasterio/discussions/2924
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix.
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/112
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81

dependabot/pip/geopandas-1.1.2

5 months, 2 weeks ago

67f5ec42

Bump geopandas from 0.5.1 to 1.1.2 Bumps [geopandas](https://github.com/geopandas/geopandas) from 0

rasterio 1.0.27 has known security vulnerabilities.

Package	Installed	Affected	Info
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'json-c' to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	>=1.0a1,<1.3.8.post1	show Rasterio 1.3.8.post1 updates its C dependency 'libwebp' to v1.3.2 to include a fix for a high-risk vulnerability. https://github.com/rasterio/rasterio/discussions/2924
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix.
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/112
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81

master

5 months, 2 weeks ago

1f8291b1

Merge pull request #602 from naturalis/dependabot/pip/scikit-learn-1.5.0 Bump scikit-learn from 0.2

geopandas 0.5.1 and rasterio 1.0.27 have known security vulnerabilities.

Package	Installed	Affected	Info
geopandas	0.5.1	<1.1.2	show Affected versions of the geopandas package are vulnerable to SQL Injection due to unsafe string interpolation of user-controlled identifiers into SQL queries. The GeoDataFrame.to_postgis() path in geopandas/io/sql.py builds the SELECT Find_SRID(...) statement using an f-string that embeds schema_name, name, and geom_name, where geom_name can be influenced via rename_geometry() and is not parameterized in affected versions.
geopandas	0.5.1	<0.14.1	show Geopandas 0.14.1 includes a fix for CVE-2023-47248, a vulnerability affecting the dependency 'pyarrow'. https://github.com/geopandas/geopandas/pull/3070
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'json-c' to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	>=1.0a1,<1.3.8.post1	show Rasterio 1.3.8.post1 updates its C dependency 'libwebp' to v1.3.2 to include a fix for a high-risk vulnerability. https://github.com/rasterio/rasterio/discussions/2924
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix.
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/112
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81

master

5 months, 2 weeks ago

025d0d1c

Merge pull request #601 from naturalis/dependabot/pip/fiona-1.10b2 Bump fiona from 1.8.6 to 1.10b2

geopandas 0.5.1, rasterio 1.0.27 and scikit-learn 0.21.3 have known security vulnerabilities.

Package	Installed	Affected	Info
geopandas	0.5.1	<1.1.2	show Affected versions of the geopandas package are vulnerable to SQL Injection due to unsafe string interpolation of user-controlled identifiers into SQL queries. The GeoDataFrame.to_postgis() path in geopandas/io/sql.py builds the SELECT Find_SRID(...) statement using an f-string that embeds schema_name, name, and geom_name, where geom_name can be influenced via rename_geometry() and is not parameterized in affected versions.
geopandas	0.5.1	<0.14.1	show Geopandas 0.14.1 includes a fix for CVE-2023-47248, a vulnerability affecting the dependency 'pyarrow'. https://github.com/geopandas/geopandas/pull/3070
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'json-c' to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	>=1.0a1,<1.3.8.post1	show Rasterio 1.3.8.post1 updates its C dependency 'libwebp' to v1.3.2 to include a fix for a high-risk vulnerability. https://github.com/rasterio/rasterio/discussions/2924
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix.
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/112
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
scikit-learn	0.21.3	<0.24.2	show Scikit-learn 0.24.2 includes a fix for a ReDoS vulnerability. https://github.com/scikit-learn/scikit-learn/issues/19522
scikit-learn	0.21.3	<1.5.0	show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
scikit-learn	0.21.3	>=0.11,<1.1.0rc1	show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.

dependabot/pip/scikit-learn-1.5.0

5 months, 2 weeks ago

5a1f3c64

Bump scikit-learn from 0.21.3 to 1.5.0 Bumps [scikit-learn](https://github.com/scikit-learn/scikit-

fiona 1.8.6, numpy 1.22.0 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
fiona	1.8.6	<=1.9.4.post1	show Fiona 1.9.4.post1 and prior releases ship with a version of 'libcurl' that has a high-severity vulnerability.
numpy	1.22.0	>=1.4.1,<1.22.2	show Numpy 1.22.2 includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place. NOTE2: The specs we include in this advisory differ from the publicly available on other sources. For example, the advisory posted by the NVD indicate that versions up to and including 1.19.0 are affected. However, research by Safety CLI Cybersecurity confirms that the vulnerability remained unaddressed until version 1.22.2.
geopandas	0.5.1	<1.1.2	show Affected versions of the geopandas package are vulnerable to SQL Injection due to unsafe string interpolation of user-controlled identifiers into SQL queries. The GeoDataFrame.to_postgis() path in geopandas/io/sql.py builds the SELECT Find_SRID(...) statement using an f-string that embeds schema_name, name, and geom_name, where geom_name can be influenced via rename_geometry() and is not parameterized in affected versions.
geopandas	0.5.1	<0.14.1	show Geopandas 0.14.1 includes a fix for CVE-2023-47248, a vulnerability affecting the dependency 'pyarrow'. https://github.com/geopandas/geopandas/pull/3070
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'json-c' to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	>=1.0a1,<1.3.8.post1	show Rasterio 1.3.8.post1 updates its C dependency 'libwebp' to v1.3.2 to include a fix for a high-risk vulnerability. https://github.com/rasterio/rasterio/discussions/2924
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix.
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/112
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81

master

5 months, 2 weeks ago

5d4645a1

Merge pull request #603 from naturalis/pyup-update-numpy-1.22.0-to-2.4.4 Update numpy to 2.4.4

fiona 1.8.6, geopandas 0.5.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
fiona	1.8.6	<=1.9.4.post1	show Fiona 1.9.4.post1 and prior releases ship with a version of 'libcurl' that has a high-severity vulnerability.
geopandas	0.5.1	<1.1.2	show Affected versions of the geopandas package are vulnerable to SQL Injection due to unsafe string interpolation of user-controlled identifiers into SQL queries. The GeoDataFrame.to_postgis() path in geopandas/io/sql.py builds the SELECT Find_SRID(...) statement using an f-string that embeds schema_name, name, and geom_name, where geom_name can be influenced via rename_geometry() and is not parameterized in affected versions.
geopandas	0.5.1	<0.14.1	show Geopandas 0.14.1 includes a fix for CVE-2023-47248, a vulnerability affecting the dependency 'pyarrow'. https://github.com/geopandas/geopandas/pull/3070
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'json-c' to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	>=1.0a1,<1.3.8.post1	show Rasterio 1.3.8.post1 updates its C dependency 'libwebp' to v1.3.2 to include a fix for a high-risk vulnerability. https://github.com/rasterio/rasterio/discussions/2924
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix.
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/112
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
scikit-learn	0.21.3	<0.24.2	show Scikit-learn 0.24.2 includes a fix for a ReDoS vulnerability. https://github.com/scikit-learn/scikit-learn/issues/19522
scikit-learn	0.21.3	<1.5.0	show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
scikit-learn	0.21.3	>=0.11,<1.1.0rc1	show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.

master

5 months, 2 weeks ago

8d85ca9a

Merge pull request #604 from naturalis/dependabot/pip/tqdm-4.66.3 Bump tqdm from 4.35.0 to 4.66.3

fiona 1.8.6, numpy 1.22.0 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
fiona	1.8.6	<=1.9.4.post1	show Fiona 1.9.4.post1 and prior releases ship with a version of 'libcurl' that has a high-severity vulnerability.
numpy	1.22.0	>=1.4.1,<1.22.2	show Numpy 1.22.2 includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place. NOTE2: The specs we include in this advisory differ from the publicly available on other sources. For example, the advisory posted by the NVD indicate that versions up to and including 1.19.0 are affected. However, research by Safety CLI Cybersecurity confirms that the vulnerability remained unaddressed until version 1.22.2.
geopandas	0.5.1	<1.1.2	show Affected versions of the geopandas package are vulnerable to SQL Injection due to unsafe string interpolation of user-controlled identifiers into SQL queries. The GeoDataFrame.to_postgis() path in geopandas/io/sql.py builds the SELECT Find_SRID(...) statement using an f-string that embeds schema_name, name, and geom_name, where geom_name can be influenced via rename_geometry() and is not parameterized in affected versions.
geopandas	0.5.1	<0.14.1	show Geopandas 0.14.1 includes a fix for CVE-2023-47248, a vulnerability affecting the dependency 'pyarrow'. https://github.com/geopandas/geopandas/pull/3070
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'json-c' to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
rasterio	1.0.27	>=1.0a1,<1.3.8.post1	show Rasterio 1.3.8.post1 updates its C dependency 'libwebp' to v1.3.2 to include a fix for a high-risk vulnerability. https://github.com/rasterio/rasterio/discussions/2924
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix.
rasterio	1.0.27	<1.3.8.post2	show Rasterio 1.3.8.post2 updates its bundled dependency 'libcurl' to v8.4.0 to include a security fix. https://github.com/rasterio/rasterio-wheels/issues/112
rasterio	1.0.27	<1.3.0	show Rasterio 1.3.0 updates its C dependency 'hdf5' to include security fixes. https://github.com/rasterio/rasterio-wheels/issues/81
scikit-learn	0.21.3	<0.24.2	show Scikit-learn 0.24.2 includes a fix for a ReDoS vulnerability. https://github.com/scikit-learn/scikit-learn/issues/19522
scikit-learn	0.21.3	<1.5.0	show A sensitive data leakage vulnerability was identified in affected versions of scikit-learn TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data within the `stop_words_` attribute, rather than only storing the subset of tokens required for the TF-IDF technique to function. This behavior leads to the potential leakage of sensitive information, as the `stop_words_` attribute could contain tokens that were meant to be discarded and not stored, such as passwords or keys. The impact of this vulnerability varies based on the nature of the data being processed by the vectorizer.
scikit-learn	0.21.3	>=0.11,<1.1.0rc1	show * Disputed * Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute.