Vulnerability in LightGBM dependency (CVE-2024-43598)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- python
- Domain
- machine-learning, security
Research direction
No dependency file or test path is named in the issue. Start by locating the declaration for LightGBM 3.3.5, then verify whether it can be updated to version 4.6.0 or later and confirm the project still installs and its existing checks pass.
Written by the indexing model from the issue text.
Description
Hello,
I'm an active user of the stringsifter library and noticed that it lists LightGBM version 3.3.5 as a dependency.
This version is affected by a high-severity remote code execution vulnerability, CVE-2024-43598.
The vulnerability is present in all versions prior to 4.6.0, which confirms that the current dependency is vulnerable.
The fix for this CVE is available in LightGBM version 4.6.0 and later. As a user, I would highly appreciate it if you could update the dependency to a secure version to mitigate this risk.
Thank you.
- Dominant language
- Python
- Stars
- 764
- Forks
- 125
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from mandiant/stringsifter
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
mandiant/stringsifter#41 · 2 comments · 2 reactions ·
-
Difficulty 3/5 1-2 days Newbie friendliness 25/100
mandiant/stringsifter#39 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
mandiant/stringsifter#37 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
mandiant/stringsifter#35 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 20/100
mandiant/stringsifter#26 · 1 comment ·
All issues in mandiant/stringsifter
Similar issues
-
P4: low tooling
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
jeffknupp/association#318 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
petercorke/robotics-toolbox-python#709 ·
Maintainers usually reply within 2 days
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
MakerYuichi/Aegis-pro#114 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
mpfaffenberger/code_puppy#985 · 2 comments ·
Maintainers usually reply within 1 day