mandiant / mandiant/stringsifter
Vulnerability in LightGBM dependency (CVE-2024-43598)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 763
- Forks
- 126
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
I'm an active user of the `stringsifter` library and noticed that it lists `LightGBM` version `3.3.5` as a dependency.
This version is affected by a high-severity remote code execution vulnerability, CVE-2024-43598.
The vulnerability is present in all versions prior to `4.6.0`, which confirms that the current dependency is vulnerable.
The fix for this CVE is available in `LightGBM` version `4.6.0` and later. As a user, I would highly appreciate it if you could update the dependency to a secure version to mitigate this risk.
Thank you.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No dependency file or test path is named in the issue. Start by locating the declaration for LightGBM 3.3.5, then verify whether it can be updated to version 4.6.0 or later and confirm the project still installs and its existing checks pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- machine-learning, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100