Command Execution Vulnerability in scikit-learn
Summary
CVE-2020-13092: scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if reduce makes an os.system call. Affects scikit-learn versions < 483cd3eaa3c636a57ebb0dc4765531183b274df0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
scikit-learn is a popular machine learning library for Python. It provides various algorithms and tools for data analysis and modeling. The library is widely used in the industry and academia for tasks such as classification, regression, clustering, and dimensionality reduction. However, scikit-learn versions up to 0.23.0 are vulnerable to a command execution vulnerability.
Vulnerability Detail
The vulnerability, identified as CVE-2020-13092, allows an attacker to execute arbitrary commands by passing a malicious file to the joblib.load() function. This can occur if the reduce method in the file makes an os.system call. It is important to note that there is a dispute regarding this issue, as the joblib.load() function is documented as unsafe, and it is the responsibility of the user to use it securely. However, the potential impact of this vulnerability can be severe, as it allows unauthorized command execution on the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by following secure coding practices and avoiding the use of joblib.load() function with untrusted files.
Conclusion
The command execution vulnerability in scikit-learn versions up to 0.23.0 can allow unauthorized command execution on the system. It is crucial to upgrade to a non-affected version and review code using the joblib.load() function. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for scikit-learn →
FAQ
scikit-learn is a machine learning library for Python that provides various algorithms and tools for data analysis and modeling.
The vulnerability allows an attacker to execute arbitrary commands on the system, potentially leading to unauthorized access or control.
To fix this vulnerability, update your scikit-learn installation to a version beyond 0.23.0 and review your code for secure usage of the joblib.load() function.
While there is no specific workaround mentioned, following secure coding practices and avoiding the use of joblib.load() function with untrusted files can mitigate the risk.
You can find more information about this vulnerability in the CVE-2020-13092 JSON report available at the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for scikit-learn.
