Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / nltk/PYSEC-2019-106
Advisory ID pypa/nltk/PYSEC-2019-106
Aliases CVE-2019-14751
GHSA-mr7p-25v2-35wr
PYSEC-2019-106
Summary NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
There are no known severity scores.
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00054.html
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00001.html
https://github.com/advisories/GHSA-mr7p-25v2-35wr
https://github.com/mssalvatore/CVE-2019-14751_PoC
https://github.com/nltk/nltk/blob/3.4.5/ChangeLog
https://github.com/nltk/nltk/commit/f59d7ed8df2e0e957f7f247fe218032abdbe9a10
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QI4IJGLZQ5S7C5LNRNROHAO2P526XE3D/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGZSSEJH7RHH3RBUEVWWYT75QU67J7SE/
https://salvatoresecurity.com/zip-slip-in-nltk-cve-2019-14751/
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.