PyPi: Jiant

CVE-2019-14751

Transitive

Safety vulnerability ID: 38864

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Aug 22, 2019 Updated at Nov 07, 2023
Scan your Python projects for vulnerabilities →

Advisory

Jiant 1.2.0 updates the NLTK requirement to version 3.4.5 to avoid a potential security issue.

Affected package

jiant

Latest version: 2.2.0

State-of-the-art Natural Language Processing toolkit for multi-task and transfer learning built on PyTorch.

Affected versions

Fixed versions

Vulnerability changelog

Highlighted changes:
- Add support for RoBERTa, XLM, and GPT-2 via `pytorch_transformers` 1.2.
- Add support for pip installation (and moved the body of `main.py` and the `config` directory to accomodate that change).
- Fix a bug that produced invalid micro/macro average scores during validation.

Minor changes:
- Refactor old GPT (v1) implementation to use `pytorch_transformers`.
- Make the code that adds git status information to logs more robust.
- Minor cleanup to data loading and to MNLI data handling logic.
- Fix a short-lived bug invalidating hypothesis-only MNLI results.
- Restore (partial) support for sequence-to-sequence tasks, though with no fully supported demonstration tasks in place yet.

Dependency changes:
- Updated requirement `pytorch_transformers` to 1.2.0.
- Updated requirement to NLTK 3.4.5 to avoid a potential security issue.

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application

Severity Details

CVSS Base Score

HIGH 7.5

CVSS v3 Details

HIGH 7.5
Attack Vector (AV)
NETWORK
Attack Complexity (AC)
LOW
Privileges Required (PR)
NONE
User Interaction (UI)
NONE
Scope (S)
UNCHANGED
Confidentiality Impact (C)
NONE
Integrity Impact (I)
HIGH
Availability Availability (A)
NONE

CVSS v2 Details

MEDIUM 5.0
Access Vector (AV)
NETWORK
Access Complexity (AC)
LOW
Authentication (Au)
NONE
Confidentiality Impact (C)
NONE
Integrity Impact (I)
PARTIAL
Availability Impact (A)
NONE