CVE-2024-39705
Fixed in a distro release EPSS 1%CVSS 9.8
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.
Products: nltk
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | nltk | 3.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-beam-python-3.11-sdk | 2.58.1-r0 |
| Chainguard | nemo | 1.23.0-r12 |
| Chainguard | py3-nltk | 3.8.2-r0 |
| Chainguard | py3-supported-nltk | 3.8.2-r0 |
| Chainguard | py3.10-nltk | 3.8.2-r0 |
| Chainguard | py3.10-nltk-bin | 3.8.2-r0 |
| Chainguard | py3.11-nltk | 3.8.2-r0 |
| Chainguard | py3.11-nltk-bin | 3.8.2-r0 |
| Chainguard | py3.12-nltk | 3.8.2-r0 |
| Chainguard | py3.12-nltk-bin | 3.8.2-r0 |
| Chainguard | py3.13-nltk | 3.8.2-r0 |
| Chainguard | py3.13-nltk-bin | 3.8.2-r0 |
| Debian 12 | nltk | no fix |
| Debian 13 | nltk | 3.9.1-1 |
| Debian 14 | nltk | 3.9.1-1 |
| SUSE Package Hub 15 SP5 | python-nltk | 3.7-bp155.3.3.1 |
| SUSE Package Hub 15 SP6 | python-nltk | 3.7-bp156.4.3.1 |
| Ubuntu 22.04 LTS | nltk | no fix |
| Ubuntu 24.04 LTS | nltk | no fix |
| Ubuntu Pro 14.04 LTS | nltk | no fix |
| Ubuntu Pro 16.04 LTS | nltk | no fix |
| Ubuntu Pro 18.04 LTS | nltk | no fix |
| Ubuntu Pro 20.04 LTS | nltk | no fix |
| Wolfi | py3-nltk | 3.8.2-r0 |
| Wolfi | py3-supported-nltk | 3.8.2-r0 |
| Wolfi | py3.10-nltk | 3.8.2-r0 |
| Wolfi | py3.10-nltk-bin | 3.8.2-r0 |
| Wolfi | py3.11-nltk | 3.8.2-r0 |
| Wolfi | py3.11-nltk-bin | 3.8.2-r0 |
| Wolfi | py3.12-nltk | 3.8.2-r0 |
| Wolfi | py3.12-nltk-bin | 3.8.2-r0 |
| Wolfi | py3.13-nltk | 3.8.2-r0 |
| Wolfi | py3.13-nltk-bin | 3.8.2-r0 |
| openSUSE Leap 15.5 | python-nltk | 3.7-bp155.3.3.1 |
| openSUSE Leap 15.6 | python-nltk | 3.7-bp156.4.3.1 |
| openSUSE Tumbleweed | python-nltk | 3.8.1-2.1 |
| openSUSE Tumbleweed | python-nltk | 3.10.1-1.1 |