Advisoriesby IbisJupyterGHSA-rv62-4pmj-xw6h
Open Redirect vulnerability in jupyterhub and notebook
Fix: upgrade to 0.9.6 or later (2 fixed versions below)
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| jupyterhub PyPI | < 0.9.6 | 0.9.6 |
| notebook PyPI | < 5.7.8 | 5.7.8 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-601
- Also known as
- CVE-2019-10255, PYSEC-2026-2683, PYSEC-2026-647
- nvd.nist.gov/vuln/detail/CVE-2019-10255
- github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb
- github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b
- github.com/jupyter/notebook/commit/d65328d4841892b412aef9015165db1eb029a8ed
- blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4
- github.com/advisories/GHSA-rv62-4pmj-xw6h
- github.com/jupyter/notebook
- github.com/jupyter/notebook/compare/05aa4b2...16cf97c
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO
More Jupyter advisories
All Jupyter
Open redirect in Jupyter NotebookCVE-2020-26215fixed in 6.1.5Cross-site scripting in Jupyter NotebookCVE-2018-21030fixed in 5.5.0rc1Jupyter Notebook open redirect vulnerabilityCVE-2019-10856fixed in 5.7.8Jupyter Notebook XSS via directory nameCVE-2018-19352fixed in 5.7.2Jupyter Notebook XSS via untrusted notebooksCVE-2018-19351fixed in 5.7.1Jupyter Notebook file bypasses sanitization, executes JavaScriptCVE-2018-8768fixed in 5.4.1