CVE-2023-40170

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2023-40170

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-40170.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2023-40170

Aliases

Related

Published

2023-08-28T21:15:07Z

Modified

2024-10-12T11:03:25.039604Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab". This issue has been addressed in commit 87a49272728 which has been included in release 2.7.2. Users are advised to upgrade. Users unable to upgrade may use the lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.

References

Affected packages

Debian:11 / jupyter-server

Package

Name: jupyter-server
Purl: pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.2.2-1

1.10.2-1

1.11.0-1

1.11.1-1

1.12.0-1

1.12.1-1

1.13.1-1

1.16.0-1

1.17.0-1

1.17.1-1

1.18.1-1

1.18.1-2

1.21.0-1

1.23.2-1

1.23.3-1

1.23.3-2

2.*

2.9.1-1

2.14.0-1

2.14.2-1

2.14.2-2

2.14.2-3

2.14.2-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / jupyter-server

Package

Name: jupyter-server
Purl: pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.23.3-1

1.23.3-2

2.*

2.9.1-1

2.14.0-1

2.14.2-1

2.14.2-2

2.14.2-3

2.14.2-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / jupyter-server

Package

Name: jupyter-server
Purl: pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.14.2-1

Affected versions

1.*

1.23.3-1

1.23.3-2

2.*

2.9.1-1

2.14.0-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/jupyter-server/jupyter_server

Affected ranges

Type: GIT
Repo: https://github.com/jupyter-server/jupyter_server
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

87a4927272819f0b1cae1afa4c8c86ee2da002fd

Affected versions

0.*

0.0.1

0.0.2

0.0.3

0.0.4

0.0.5

0.1.0

0.1.1

0.2.0

0.3.0

1.*

1.0.0

1.0.0rc1

1.0.0rc10

1.0.0rc11

1.0.0rc12

1.0.0rc13

1.0.0rc14

1.0.0rc15

1.0.0rc16

1.0.0rc2

1.0.0rc3

1.0.0rc4

1.0.0rc5

1.0.0rc6

1.0.0rc7

1.0.0rc8

1.0.0rc9

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.2.0

1.2.1

1.2.2

1.2.3

1.3.0

1.4.0

1.4.1

1.5.0

1.5.1

1.6.0

1.6.1

v1.*

v1.10.0

v1.10.1

v1.10.2

v1.11.0

v1.11.1

v1.11.2

v1.12.0

v1.12.1

v1.13.0

v1.13.1

v1.13.2

v1.13.3

v1.13.4

v1.13.5

v1.15.0

v1.15.1

v1.15.2

v1.15.3

v1.15.4

v1.15.5

v1.15.6

v1.16.0

v1.6.2

v1.6.3

v1.6.4

v1.7.0

v1.7.0a0

v1.7.0a1

v1.7.0a2

v1.8.0

v1.9.0

v2.*

v2.0.0

v2.0.0a0

v2.0.0a1

v2.0.0a2

v2.0.0b0

v2.0.0b1

v2.0.0rc0

v2.0.0rc1

v2.0.0rc2

v2.0.0rc3

v2.0.0rc4

v2.0.0rc5

v2.0.0rc6

v2.0.0rc7

v2.0.0rc8

v2.0.1

v2.0.2

v2.0.3

v2.0.4

v2.0.5

v2.0.6

v2.0.7

v2.1.0

v2.2.0

v2.2.1

v2.3.0

v2.4.0

v2.5.0

v2.6.0

v2.7.0

v2.7.1