Deserialization of Untrusted Data in Natural Language Toolkit - CVE-2024-39705

Vulnerability identifier: #VU96903

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-39705

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the pickle module. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Natural Language Toolkit
QRadar Suite
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Maximo Application Suite - AI Broker
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Robotic Process Automation
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

Natural Language Toolkit - update to 3.8.2
QRadar Suite - update to 1.10.25.0
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.1, 5.1.2, 5.1.3
IBM Maximo Application Suite - AI Broker - update to 9.0.2
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.1
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.1.1
watsonx Assistant Cartridge - update to 5.1.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
IBM Robotic Process Automation - addressed in versions 21.0.7.18, 23.0.18
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.18, 23.0.18

• https://github.com/nltk/nltk/issues/3266
• https://github.com/nltk/nltk/issues/2522
• https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706

• Remote code execution in Python NLTK library
• Multiple vulnerabilities in IBM QRadar Suite software
• IBM Maximo Application Suite - AI Broker update for nltk-3.8.1-py3-none-any.whl
• Multiple vulnerabilities in IBM Robotic Process Automation
• IBM Watson Assistant for IBM Cloud Pak for Data update for NLTK
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Natural Language Toolkit (NLTK)
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component update for Natural Language Toolkit (NLTK)
• Multiple vulnerabilities in IBM Watson Knowledge Catalog