Bug 1227174 (CVE-2024-39705) - VUL-0: CVE-2024-39705: python-nltk: remote code execution through the integrated data package download functionality
Summary: VUL-0: CVE-2024-39705: python-nltk: remote code execution through the integra...
Status: NEW
Alias: CVE-2024-39705
Product: openSUSE Distribution
Classification: openSUSE
Component: Security (show other bugs)
Version: Leap 15.6
Hardware: Other Other
: P3 - Medium : Normal (vote)
Target Milestone: ---
Assignee: Python maintainers (group account)
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/412359/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-28 12:38 UTC by SMASH SMASH
Modified: 2024-07-10 09:22 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-06-28 12:38:39 UTC 
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-39705
https://www.cve.org/CVERecord?id=CVE-2024-39705
https://github.com/nltk/nltk/issues/2522
https://github.com/nltk/nltk/issues/3266
https://bugzilla.redhat.com/show_bug.cgi?id=2294671
Comment 3 Matej Cepl 2024-07-01 08:03:48 UTC 
Yes, downloading and using pickles from the Internet is certainly a security issue, and exactly the thing the pickle module documentation warns programmers not to do (https://docs.python.org/3/library/pickle.html).

However, removing of the network downloading functionality probably requires refactoring a big chunk of code.

Waiting on upstream for their solution.
Comment 4 Marcus Meissner 2024-07-01 10:06:23 UTC 
I recommended to Matej to temporary disable this dangerous functionality.
Comment 5 OBSbugzilla Bot 2024-07-03 08:15:02 UTC 
This is an autogenerated message for OBS integration:
This bug (1227174) was mentioned in
https://build.opensuse.org/request/show/1185062 Factory / python-nltk
Comment 6 Matej Cepl 2024-07-03 09:20:25 UTC 
This is just preliminary version, which needs to be discussed with the upstream.