Advisoriesby IbisIPythonGHSA-7fc2-rm35-2pp7
IPython vulnerable to cross site request forgery (CSRF)
Fix: upgrade to 2.4.1 or later (2 fixed versions below)
IPython (Interactive Python) is a command shell. Cross-site request forgery in the REST API is possible in in IPython 2 and 3. Versions 2.4.1 and 3.2.3 contain patches.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| ipython PyPI | >= 0.12, < 2.4.1 | 2.4.1 |
| >= 3.0.0, < 3.2.3 | 3.2.3 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-352
- Also known as
- CVE-2015-5607, PYSEC-2017-47
- nvd.nist.gov/vuln/detail/CVE-2015-5607
- github.com/ipython/ipython/commit/1415a9710407e7c14900531813c15ba6165f0816
- github.com/ipython/ipython/commit/a05fe052a18810e92d9be8c1185952c13fe4e5b0
- bugzilla.redhat.com/show_bug.cgi?id=1243842
- github.com/advisories/GHSA-7fc2-rm35-2pp7
- github.com/ipython/ipython
- github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2017-47.yaml
- lists.fedoraproject.org/pipermail/package-announce/2015-July/162671.html
- lists.fedoraproject.org/pipermail/package-announce/2015-July/162936.html
- www.openwall.com/lists/oss-security/2015/07/21/3
More IPython advisories
All IPython
IPython vulnerable to command injection via set_term_titleCVE-2023-24816fixed in 8.10.0Improper Neutralization of Input During Web Page Generation in IPythonCVE-2015-4706fixed in 3.2.0IPython Notebook vulnerable to improper validation of the origin of websocket requestsCVE-2014-3429fixed in 1.2.0Improper Neutralization of Input During Web Page Generation in IPythonCVE-2015-4707fixed in 3.2.0Execution with Unnecessary Privileges in ipythonCVE-2022-21699fixed in 5.11 +3