CVE-2023-39968

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-39968

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-39968.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2023-39968

Aliases

Related

Published

2023-08-28T21:15:07Z

Modified

2024-10-12T11:02:50.723258Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit 29036259 which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

References

Affected packages

Debian:11 / jupyter-server

Package

Name: jupyter-server
Purl: pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.2-1

1.10.2-1

1.11.0-1

1.11.1-1

1.12.0-1

1.12.1-1

1.13.1-1

1.16.0-1

1.17.0-1

1.17.1-1

1.18.1-1

1.18.1-2

1.21.0-1

1.23.2-1

1.23.3-1

1.23.3-2

2.*

2.9.1-1

2.14.0-1

2.14.2-1

2.14.2-2

2.14.2-3

2.14.2-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / jupyter-server

Package

Name: jupyter-server
Purl: pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.23.3-1

1.23.3-2

2.*

2.9.1-1

2.14.0-1

2.14.2-1

2.14.2-2

2.14.2-3

2.14.2-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / jupyter-server

Package

Name: jupyter-server
Purl: pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.14.2-1

Affected versions

1.*

1.23.3-1

1.23.3-2

2.*

2.9.1-1

2.14.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/jupyter-server/jupyter_server

Affected ranges

Type: GIT
Repo: https://github.com/jupyter-server/jupyter_server
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

290362593b2ffb23c59f8114d76f77875de4b925

Affected versions

0.*

0.0.1

0.0.2

0.0.3

0.0.4

0.0.5

0.1.0

0.1.1

0.2.0

0.3.0

1.*

1.0.0

1.0.0rc1

1.0.0rc10

1.0.0rc11

1.0.0rc12

1.0.0rc13

1.0.0rc14

1.0.0rc15

1.0.0rc16

1.0.0rc2

1.0.0rc3

1.0.0rc4

1.0.0rc5

1.0.0rc6

1.0.0rc7

1.0.0rc8

1.0.0rc9

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.2.0

1.2.1

1.2.2

1.2.3

1.3.0

1.4.0

1.4.1

1.5.0

1.5.1

1.6.0

1.6.1

v1.*

v1.10.0

v1.10.1

v1.10.2

v1.11.0

v1.11.1

v1.11.2

v1.12.0

v1.12.1

v1.13.0

v1.13.1

v1.13.2

v1.13.3

v1.13.4

v1.13.5

v1.15.0

v1.15.1

v1.15.2

v1.15.3

v1.15.4

v1.15.5

v1.15.6

v1.16.0

v1.6.2

v1.6.3

v1.6.4

v1.7.0

v1.7.0a0

v1.7.0a1

v1.7.0a2

v1.8.0

v1.9.0

v2.*

v2.0.0

v2.0.0a0

v2.0.0a1

v2.0.0a2

v2.0.0b0

v2.0.0b1

v2.0.0rc0

v2.0.0rc1

v2.0.0rc2

v2.0.0rc3

v2.0.0rc4

v2.0.0rc5

v2.0.0rc6

v2.0.0rc7

v2.0.0rc8

v2.0.1

v2.0.2

v2.0.3

v2.0.4

v2.0.5

v2.0.6

v2.0.7

v2.1.0

v2.2.0

v2.2.1

v2.3.0

v2.4.0

v2.5.0

v2.6.0

v2.7.0

v2.7.1