CVE-2021-3828

The nltk package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide as an input to the [_read_comparison_block()(https://github.com/nltk/nltk/blob/23f4b1c4b4006b0cb3ec278e801029557cec4e82/nltk/corpus/reader/comparative_sents.py#L259) function in the file nltk/corpus/reader/comparative_sents.py may cause an application to consume an excessive amount of CPU.

nltk is vulnerable to Inefficient Regular Expression Complexity

python-nltk 3.6.6 update resolves ReDoS opportunity by fixing incorrectly specified regex

This update for python-nltk fixes the following issues:

Update to 3.7

• Improve and update the NLTK team page on nltk.org (#2855, #2941)

• Drop support for Python 3.6, support Python 3.10 (#2920)

• Update to 3.6.7

  • Resolve IndexError in sent_tokenize and word_tokenize (#2922)

• Update to 3.6.6

  • Refactor gensim.doctest to work for gensim 4.0.0 and up (#2914)
  • Add Precision, Recall, F-measure, Confusion Matrix to Taggers (#2862)
  • Added warnings if .zip files exist without any corresponding .csv files. (#2908)
  • Fix FileNotFoundError when the download_dir is a non-existing nested folder (#2910)
  • Rename omw to omw-1.4 (#2907)
  • Resolve ReDoS opportunity by fixing incorrectly specified regex (#2906, boo#1191030, CVE-2021-3828).
  • Support OMW 1.4 (#2899)
  • Deprecate Tree get and set node methods (#2900)
  • Fix broken inaugural test case (#2903)
  • Use Multilingual Wordnet Data from OMW with newer Wordnet versions (#2889)
  • Keep NLTKs 'tokenize' module working with pathlib (#2896)
  • Make prettyprinter to be more readable (#2893)
  • Update links to the nltk book (#2895)
  • Add CITATION.cff to nltk (#2880)
  • Resolve serious ReDoS in PunktSentenceTokenizer (#2869)
  • Delete old CI config files (#2881)
  • Improve Tokenize documentation + add TokenizerI as superclass for TweetTokenizer (#2878)
  • Fix expected value for BLEU score doctest after changes from #2572
  • Add multi Bleu functionality and tests (#2793)
  • Deprecate 'return_str' parameter in NLTKWordTokenizer and TreebankWordTokenizer (#2883)
  • Allow empty string in CFG's + more (#2888)
  • Partition tree.py module into tree package + pickle fix (#2863)
  • Fix several TreebankWordTokenizer and NLTKWordTokenizer bugs (#2877)
  • Rewind Wordnet data file after each lookup (#2868)
  • Correct init call for SyntaxCorpusReader subclasses (#2872)
  • Documentation fixes (#2873)
  • Fix levenstein distance for duplicated letters (#2849)
  • Support alternative Wordnet versions (#2860)
  • Remove hundreds of formatting warnings for nltk.org (#2859)
  • Modernize nltk.org/howto pages (#2856)
  • Fix Bleu Score smoothing function from taking log(0) (#2839)
  • Update third party tools to newer versions and removing MaltParser fixed version (#2832)
  • Fix TypeError: _pretty() takes 1 positional argument but 2 were given in sem/drt.py (#2854)
  • Replace http with https in most URLs (#2852)

• Update to 3.6.5

  • modernised nltk.org website
  • addressed LGTM.com issues
  • support ZWJ sequences emoji and skin tone modifer emoji in TweetTokenizer
  • METEOR evaluation now requires pre-tokenized input
  • Code linting and type hinting
  • implement get_refs function for DrtLambdaExpression
  • Enable automated CoreNLP, Senna, Prover9/Mace4, Megam, MaltParser CI tests
  • specify minimum regex version that supports regex.Pattern
  • avoid re.Pattern and regex.Pattern which fail for Python 3.6, 3.7

• Update to 3.6.4

  • deprecate nltk.usage(obj) in favor of help(obj)
  • resolve ReDoS vulnerability in Corpus Reader
  • solidify performance tests
  • improve phone number recognition in tweet tokenizer
  • refactored CISTEM stemmer for German
  • identify NLTK Team as the author
  • replace travis badge with github actions badge
  • add SECURITY.md

• Update to 3.6.3

  • Dropped support for Python 3.5
  • Run CI tests on Windows, too
  • Moved from Travis CI to GitHub Actions
  • Code and comment cleanups
  • Visualize WordNet relation graphs using Graphviz
  • Fixed large error in METEOR score
  • Apply isort, pyupgrade, black, added as pre-commit hooks
  • Prevent debug_decisions in Punkt from throwing IndexError
  • Resolved ZeroDivisionError in RIBES with dissimilar sentences
  • Initialize WordNet IC total counts with smoothing value
  • Fixed AttributeError for Arabic ARLSTem2 stemmer
  • Many fixes and improvements to lm language…

These are all security issues fixed in the python310-nltk-3.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-nltk-3.9.1-2.4 package on the GA media of openSUSE Tumbleweed.

nltk is vulnerable to Inefficient Regular Expression Complexity

Srikantha Prathi discovered that NLTK incorrectly handled specially crafted input. An attacker could use this vulnerability to cause a denial of service.