🛡️ MGASA-2024-0228 — python-scikit-learn

Updated python-scikit-learn packages fix security vulnerability

A sensitive data leakage vulnerability was identified in scikit-learn's

TfidfVectorizer, specifically in versions up to and including

1.4.1.post1, which was fixed in version 1.5.0. The vulnerability arises

from the unexpected storage of all tokens present in the training data

within the stop_words_ attribute, rather than only storing the subset

of tokens required for the TF-IDF technique to function. This behavior

leads to the potential leakage of sensitive information, as the

stop_words_ attribute could contain tokens that were meant to be

discarded and not stored, such as passwords or keys. The impact of this

vulnerability varies based on the nature of the data being processed by

the vectorizer.