CVE-2019-14751

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

Updated python-ntlk package fixes security vulnerability:

A vulnerability was found in NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ in an NLTK package (ZIP archive) that is mishandled during extraction (CVE-2019-14751).

This update for python-nltk fixes the following issues:

Update to 3.4.5 (boo#1146427, CVE-2019-14751):

• CVE-2019-14751: Fixed Zip slip vulnerability in downloader for the unlikely situation where a user configures their downloader to use a compromised server (boo#1146427)

Update to 3.4.4:

• fix bug in plot function (probability.py)
• add improved PanLex Swadesh corpus reader
• add Text.generate()
• add QuadgramAssocMeasures
• add SSP to tokenizers
• return confidence of best tag from AveragedPerceptron
• make plot methods return Axes objects
• don't require list arguments to PositiveNaiveBayesClassifier.train
• fix Tree classes to work with native Python copy library
• fix inconsistency for NomBank
• fix random seeding in LanguageModel.generate
• fix ConditionalFreqDist mutation on tabulate/plot call
• fix broken links in documentation
• fix misc Wordnet issues
• update installation instructions

Version update to 3.4.1:

• add chomsky_normal_form for CFGs
• add meteor score
• add minimum edit/Levenshtein distance based alignment function
• allow access to collocation list via text.collocation_list()
• support corenlp server options
• drop support for Python 3.4
• other minor fixes

Update to v3.4:

• Support Python 3.7
• New Language Modeling package
• Cistem Stemmer for German
• Support Russian National Corpus incl POS tag model
• Krippendorf Alpha inter-rater reliability test
• Comprehensive code clean-ups
• Switch continuous integration from Jenkins to Travis

Updated to v3.3:

• Support Python 3.6
• New interface to CoreNLP
• Support synset retrieval by sense key
• Minor fixes to CoNLL Corpus Reader
• AlignedSent
• Fixed minor inconsistencies in APIs and API documentation
• Better conformance to PEP8
• Drop Moses Tokenizer (incompatible license)

This update for python-nltk fixes the following issues:

Update to 3.4.5 (boo#1146427, CVE-2019-14751):

• CVE-2019-14751: Fixed Zip slip vulnerability in downloader for the unlikely situation where a user configures their downloader to use a compromised server (boo#1146427)

Update to 3.4.4:

• fix bug in plot function (probability.py)
• add improved PanLex Swadesh corpus reader
• add Text.generate()
• add QuadgramAssocMeasures
• add SSP to tokenizers
• return confidence of best tag from AveragedPerceptron
• make plot methods return Axes objects
• don't require list arguments to PositiveNaiveBayesClassifier.train
• fix Tree classes to work with native Python copy library
• fix inconsistency for NomBank
• fix random seeding in LanguageModel.generate
• fix ConditionalFreqDist mutation on tabulate/plot call
• fix broken links in documentation
• fix misc Wordnet issues
• update installation instructions

Version update to 3.4.1:

• add chomsky_normal_form for CFGs
• add meteor score
• add minimum edit/Levenshtein distance based alignment function
• allow access to collocation list via text.collocation_list()
• support corenlp server options
• drop support for Python 3.4
• other minor fixes

Update to v3.4:

• Support Python 3.7
• New Language Modeling package
• Cistem Stemmer for German
• Support Russian National Corpus incl POS tag model
• Krippendorf Alpha inter-rater reliability test
• Comprehensive code clean-ups
• Switch continuous integration from Jenkins to Travis

Updated to v3.3:

• Support Python 3.6
• New interface to CoreNLP
• Support synset retrieval by sense key
• Minor fixes to CoNLL Corpus Reader
• AlignedSent
• Fixed minor inconsistencies in APIs and API documentation
• Better conformance to PEP8
• Drop Moses Tokenizer (incompatible license)

This update was imported from the openSUSE:Leap:15.1:Update update project.

This update for python-nltk fixes the following issues:

Update to 3.7

• Improve and update the NLTK team page on nltk.org (#2855, #2941)

• Drop support for Python 3.6, support Python 3.10 (#2920)

• Update to 3.6.7

  • Resolve IndexError in sent_tokenize and word_tokenize (#2922)

• Update to 3.6.6

  • Refactor gensim.doctest to work for gensim 4.0.0 and up (#2914)
  • Add Precision, Recall, F-measure, Confusion Matrix to Taggers (#2862)
  • Added warnings if .zip files exist without any corresponding .csv files. (#2908)
  • Fix FileNotFoundError when the download_dir is a non-existing nested folder (#2910)
  • Rename omw to omw-1.4 (#2907)
  • Resolve ReDoS opportunity by fixing incorrectly specified regex (#2906, boo#1191030, CVE-2021-3828).
  • Support OMW 1.4 (#2899)
  • Deprecate Tree get and set node methods (#2900)
  • Fix broken inaugural test case (#2903)
  • Use Multilingual Wordnet Data from OMW with newer Wordnet versions (#2889)
  • Keep NLTKs 'tokenize' module working with pathlib (#2896)
  • Make prettyprinter to be more readable (#2893)
  • Update links to the nltk book (#2895)
  • Add CITATION.cff to nltk (#2880)
  • Resolve serious ReDoS in PunktSentenceTokenizer (#2869)
  • Delete old CI config files (#2881)
  • Improve Tokenize documentation + add TokenizerI as superclass for TweetTokenizer (#2878)
  • Fix expected value for BLEU score doctest after changes from #2572
  • Add multi Bleu functionality and tests (#2793)
  • Deprecate 'return_str' parameter in NLTKWordTokenizer and TreebankWordTokenizer (#2883)
  • Allow empty string in CFG's + more (#2888)
  • Partition tree.py module into tree package + pickle fix (#2863)
  • Fix several TreebankWordTokenizer and NLTKWordTokenizer bugs (#2877)
  • Rewind Wordnet data file after each lookup (#2868)
  • Correct init call for SyntaxCorpusReader subclasses (#2872)
  • Documentation fixes (#2873)
  • Fix levenstein distance for duplicated letters (#2849)
  • Support alternative Wordnet versions (#2860)
  • Remove hundreds of formatting warnings for nltk.org (#2859)
  • Modernize nltk.org/howto pages (#2856)
  • Fix Bleu Score smoothing function from taking log(0) (#2839)
  • Update third party tools to newer versions and removing MaltParser fixed version (#2832)
  • Fix TypeError: _pretty() takes 1 positional argument but 2 were given in sem/drt.py (#2854)
  • Replace http with https in most URLs (#2852)

• Update to 3.6.5

  • modernised nltk.org website
  • addressed LGTM.com issues
  • support ZWJ sequences emoji and skin tone modifer emoji in TweetTokenizer
  • METEOR evaluation now requires pre-tokenized input
  • Code linting and type hinting
  • implement get_refs function for DrtLambdaExpression
  • Enable automated CoreNLP, Senna, Prover9/Mace4, Megam, MaltParser CI tests
  • specify minimum regex version that supports regex.Pattern
  • avoid re.Pattern and regex.Pattern which fail for Python 3.6, 3.7

• Update to 3.6.4

  • deprecate nltk.usage(obj) in favor of help(obj)
  • resolve ReDoS vulnerability in Corpus Reader
  • solidify performance tests
  • improve phone number recognition in tweet tokenizer
  • refactored CISTEM stemmer for German
  • identify NLTK Team as the author
  • replace travis badge with github actions badge
  • add SECURITY.md

• Update to 3.6.3

  • Dropped support for Python 3.5
  • Run CI tests on Windows, too
  • Moved from Travis CI to GitHub Actions
  • Code and comment cleanups
  • Visualize WordNet relation graphs using Graphviz
  • Fixed large error in METEOR score
  • Apply isort, pyupgrade, black, added as pre-commit hooks
  • Prevent debug_decisions in Punkt from throwing IndexError
  • Resolved ZeroDivisionError in RIBES with dissimilar sentences
  • Initialize WordNet IC total counts with smoothing value
  • Fixed AttributeError for Arabic ARLSTem2 stemmer
  • Many fixes and improvements to lm language…

These are all security issues fixed in the python36-nltk-3.5-1.10 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-nltk-3.8.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-nltk-3.10.1-1.1 package on the GA media of openSUSE Tumbleweed.

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.

Mike Salvatore discovered that NLTK mishandled crafted ZIP archives during extraction. A remote attacker could use this vulnerability to write arbitrary files to the filesystem