GHSA-64x5-55rw-9974

Source

https://github.com/advisories/GHSA-64x5-55rw-9974

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-64x5-55rw-9974/GHSA-64x5-55rw-9974.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-64x5-55rw-9974

Aliases

Published

2023-08-29T23:34:09Z

Modified

2024-02-16T05:23:00.399819Z

Severity

4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Calculator

Summary

cross-site inclusion (XSSI) of files in jupyter-server

Details

Impact

Improper cross-site credential checks on /files/ URLs could allow exposure of certain file contents, or accessing files when opening untrusted files via "Open image in new tab".

Patches

Jupyter Server 2.7.2

Workarounds

Use lower performance --ContentsManager.files_handler_class=jupyter_server.files.handlers.FilesHandler, which implements the correct checks.

References

Upstream patch for CVE-2019-9644 was not applied completely, leaving part of the vulnerability open.

Vulnerability reported by Tim Coen via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.

Database specific

{
    "nvd_published_at": "2023-08-28T21:15:07Z",
    "cwe_ids": [
        "CWE-284",
        "CWE-306",
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-29T23:34:09Z"
}

References

Affected packages

PyPI / jupyter-server

Package

Name: jupyter-server; View open source insights on deps.dev
Purl: pkg:pypi/jupyter-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.7.2

Affected versions

0.*

0.0.0

0.0.1

0.0.2

0.0.3

0.0.4

0.0.5

0.1.0

0.1.1

0.2.0

0.2.1

0.3.0

1.*

1.0.0rc0

1.0.0rc1

1.0.0rc2

1.0.0rc3

1.0.0rc4

1.0.0rc5

1.0.0rc6

1.0.0rc7

1.0.0rc8

1.0.0rc9

1.0.0rc10

1.0.0rc11

1.0.0rc12

1.0.0rc13

1.0.0rc14

1.0.0rc15

1.0.0rc16

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.2.0

1.2.1

1.2.2

1.2.3

1.3.0

1.4.0

1.4.1

1.5.0

1.5.1

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.7.0a1

1.7.0a2

1.7.0

1.8.0

1.9.0

1.10.0

1.10.1

1.10.2

1.11.0

1.11.1

1.11.2

1.12.0

1.12.1

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4

1.13.5

1.15.0

1.15.1

1.15.2

1.15.3

1.15.4

1.15.5

1.15.6

1.16.0

1.17.0

1.17.1

1.18.0

1.18.1

1.19.0

1.19.1

1.21.0

1.23.0

1.23.1

1.23.2

1.23.3

1.23.4

1.23.5

1.23.6

1.24.0

2.*

2.0.0a0

2.0.0a1

2.0.0a2

2.0.0b0

2.0.0b1

2.0.0rc0

2.0.0rc1

2.0.0rc2

2.0.0rc3

2.0.0rc4

2.0.0rc5

2.0.0rc6

2.0.0rc7

2.0.0rc8

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.1.0

2.2.0

2.2.1

2.3.0

2.4.0

2.5.0

2.6.0

2.7.0

2.7.1