UBUNTU-CVE-2018-19351

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2018-19351
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-19351.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2018-19351
Related
Published
2018-11-18T17:29:00Z
Modified
2018-11-18T17:29:00Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.

References

Affected packages

Ubuntu:18.04:LTS / jupyter-notebook

Package

Name
jupyter-notebook
Purl
pkg:deb/ubuntu/jupyter-notebook@5.2.2-1ubuntu0.1?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.2.2-1ubuntu0.1

Affected versions

4.*

4.2.3-4

5.*

5.1.0-2
5.2.1-2
5.2.2-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "python3-notebook": "5.2.2-1ubuntu0.1",
            "python-notebook-doc": "5.2.2-1ubuntu0.1",
            "python-notebook": "5.2.2-1ubuntu0.1",
            "jupyter-notebook": "5.2.2-1ubuntu0.1"
        }
    ]
}

Ubuntu:20.04:LTS / jupyter-notebook

Package

Name
jupyter-notebook
Purl
pkg:deb/ubuntu/jupyter-notebook@6.0.3-2?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.3-2

Affected versions

5.*

5.7.8-1

6.*

6.0.0-1
6.0.0-2
6.0.2-1
6.0.3-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "python3-notebook": "6.0.3-2",
            "python-notebook-doc": "6.0.3-2",
            "jupyter-notebook": "6.0.3-2"
        }
    ]
}

Ubuntu:22.04:LTS / jupyter-notebook

Package

Name
jupyter-notebook
Purl
pkg:deb/ubuntu/jupyter-notebook@6.4.8-1?arch=src?distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.4.8-1

Affected versions

6.*

6.2.0-1
6.4.5-2
6.4.5-3
6.4.5-4

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "python3-notebook": "6.4.8-1",
            "python-notebook-doc": "6.4.8-1",
            "jupyter-notebook": "6.4.8-1"
        }
    ]
}