dependabot-preview[bot]
commented
4 years ago We've just been alerted that this update fixes a security vulnerability:
Sourced from The GitHub Security Advisory Database.
Moderate severity vulnerability that affects nltk NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.
Affected versions: ["< 3.4.5"]
Bumps nltk from 3.4.4 to 3.4.5.
Changelog
*Sourced from [nltk's changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog).* > Version 3.5 2019-08-07 > * drop support for Python 2 > * minor bug fixes and clean ups > > Thanks to the following contributors to 3.5: > Nicolas Darr, Gerhard Kremer, Liling Tan > > Version 3.4.5 2019-08-20 > * Fixed security bug in downloader: Zip slip vulnerability - for the unlikely > situation where a user configures their downloader to use a compromised server > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14751) > > Thanks to the following contributors to 3.4.5: > Mike Salvatore > > Version 3.4.4 2019-07-04 > * fix bug in plot function (probability.py) > * add improved PanLex Swadesh corpus reader > > Thanks to the following contributors to 3.4.4: > Devashish Lal, Liling Tan > > Version 3.4.3 2019-06-07 > > * add Text.generate() > * add QuadgramAssocMeasures > * add SSP to tokenizers > * return confidence of best tag from AveragedPerceptron > * make plot methods return Axes objects > * don't require list arguments to PositiveNaiveBayesClassifier.train > * fix Tree classes to work with native Python copy library > * fix inconsistency for NomBank > * fix random seeding in LanguageModel.generate > * fix ConditionalFreqDist mutation on tabulate/plot call > * fix broken links in documentation > * fix misc Wordnet issues > * update installation instructions > > Thanks to the following contributors to 3.4.3: > alvations, Bharat123rox, cifkao, drewmiller, free-variation, henchc > irisxzhou, nick-ulle, ppartarr, simonepri, yigitsever, zhaoyanpeng > > Version 3.4.1 2019-04-17 > > * add chomsky_normal_form for CFGs > * add meteor score > * add minimum edit/Levenshtein distance based alignment function > * allow access to collocation list via text.collocation_list() > * support corenlp server options > * drop support for Python 3.4 > ... (truncated)Commits
- [`acca8d5`](https://github.com/nltk/nltk/commit/acca8d573878e173379fe190d7f14f298b12dac9) updates for 3.4.5 - [`083bbf0`](https://github.com/nltk/nltk/commit/083bbf00fcc3b5e944fa5e2708a9a06769af0d5b) updates for 3.4.5 - [`f59d7ed`](https://github.com/nltk/nltk/commit/f59d7ed8df2e0e957f7f247fe218032abdbe9a10) CVE-2019-14751: - See full diff in [compare view](https://github.com/nltk/nltk/compare/3.4.4...3.4.5)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) Finally, you can contact us by mentioning @dependabot.