REDHAT-BUG-2449836: High severity nltk Natural Language Toolkit (NLTK) vulnerability
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, nltk.app.wordnetapp allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os.exit(0), resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch bbaae83db86a0f49e00f5b0db44a7254c268de9b
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2449836?
The severity of REDHAT-BUG-2449836 is classified as high with a score of 7.
What vulnerability does REDHAT-BUG-2449836 describe?
REDHAT-BUG-2449836 describes a vulnerability in NLTK that allows unauthenticated remote shutdown of the local WordNet Browser HTTP server.
Which versions of NLTK are affected by REDHAT-BUG-2449836?
NLTK versions 3.9.3 and prior are affected by the vulnerability described in REDHAT-BUG-2449836.
How do I fix REDHAT-BUG-2449836?
To fix REDHAT-BUG-2449836, update NLTK to a version later than 3.9.3 to mitigate the vulnerability.
What kind of application is affected by REDHAT-BUG-2449836?
The application affected by REDHAT-BUG-2449836 is the WordNet Browser within the NLTK suite.