Advisoriesby IbisJupyterGHSA-92mr-v722-f48m
Improper Input Validation in Jupyter Notebook
Fix: upgrade to 4.0.5 or later (2 fixed versions below)
The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
Affected versions
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-20
- Also known as
- CVE-2015-7337, PYSEC-2015-25, PYSEC-2015-27
- nvd.nist.gov/vuln/detail/CVE-2015-7337
- github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967
- github.com/jupyter/notebook/commit/9e63dd89b603dfbe3a7e774d8a962ee0fa30c0b5
- bugzilla.redhat.com/show_bug.cgi?id=1264067
- github.com/advisories/GHSA-92mr-v722-f48m
- github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2015-25.yaml
- github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2015-27.yaml
- security.gentoo.org/glsa/201512-02
- lists.fedoraproject.org/pipermail/package-announce/2015-September/167670.html
- seclists.org/oss-sec/2015/q3/558
- seclists.org/oss-sec/2015/q3/634
More Jupyter advisories
All Jupyter
Jupyter server Token bruteforcingCVE-2022-29241fixed in 1.17.1 +1Token bruteforcingCVE-2022-29238fixed in 6.4.12Cross-Site Request Forgery in JupyterHubCVE-2020-36191fixed in 1.2.0b1Improper Neutralization of Input During Web Page Generation in Jupyter NotebookCVE-2015-6938fixed in 4.0.5 +1Improper Neutralization of Input During Web Page Generation in Jupyter NotebookCVE-2019-9644fixed in 5.7.6Sensitive Auth & Cookie data stored in Jupyter server logsCVE-2022-24758fixed in 6.4.10