CVE-2024-39705
Publication date 27 June 2024
Last updated 11 July 2025
Ubuntu priority
Description
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| nltk | ||
| 24.04 LTS noble | Ignored changes too intrusive | |
| 22.04 LTS jammy | Ignored changes too intrusive | |
| 20.04 LTS focal | Ignored changes too intrusive | |
| 18.04 LTS bionic | Ignored changes too intrusive | |
| 16.04 LTS xenial | Ignored changes too intrusive | |
| 14.04 LTS trusty | Ignored changes too intrusive |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
9.8 · Critical
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |