CVE-2020-13092: Critical severity scikit-learn vulnerability
DISPUTED scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the joblib.load() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner.
Other sources
scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the joblib.load() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-13092?
CVE-2020-13092 is considered a medium severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2020-13092?
To mitigate CVE-2020-13092, upgrade to scikit-learn version 0.24.0 or later where this issue is resolved.
What software is affected by CVE-2020-13092?
CVE-2020-13092 affects scikit-learn versions up to and including 0.23.0.
What is the nature of the vulnerability in CVE-2020-13092?
CVE-2020-13092 involves the unserialization of untrusted files through the joblib.load() function which can lead to the execution of arbitrary commands.
Is CVE-2020-13092 a confirmed vulnerability?
CVE-2020-13092 is disputed by some parties who claim that the joblib.load() function is documented as unsafe.