CVE-2019-14751
python3-nltk: NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via...
CVE-2019-14751 is fixed in 2 products on 1 platform, first by python-nltk 3.2.5-1ubuntu0.1, released August 19, 2019. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0567
93rd percentile
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| python-nltk · Ubuntu 18.04.6 LTS (bionic) | 3.2.5-1ubuntu0.1 | python-nltk 3.2.5-1ubuntu0.1 | Aug 19, 2019 |
| python3-nltk · Ubuntu 18.04.6 LTS (bionic) | 3.2.5-1ubuntu0.1 | python3-nltk 3.2.5-1ubuntu0.1 | Aug 19, 2019 |