PT-2018-18623 · Project Jupyter+1 · Jupyter Notebook+1

Publicado 2018-03-18 · Atualizado 2021-03-15 · CVE-2018-8768

Positive Technologies (AI Summary)

CVSS v4.0

8.4

Alta

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jupyter Notebook versions prior to 5.4.1

Description A maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.

Recommendations For versions prior to 5.4.1, update to version 5.4.1 or later to resolve the issue. As a temporary workaround, consider disabling the use of jQuery in the notebook context until a patch is available. Restrict access to maliciously forged notebook files to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2018-8768

DLA-2432-1

GHSA-6CWV-X26C-W2Q4

MGASA-2018-0182

OPENSUSE-SU-2024:11242-1

PYSEC-2018-57

USN-4855-1

Produtos afetados

Jupyter Notebook

Ubuntu

Referências · 22

• https://github.com/jupyter/notebook · Nota
• https://github.com/jupyter/notebook/commit/4e79ebb49acac722b37b03f1fe811e67590d3831 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2018-57.yaml · Nota
• https://osv.dev/vulnerability/CVE-2018-8768 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2018-0182.html · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-8768 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-4855-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-8768 · Aviso do Fabricante
• https://github.com/advisories/GHSA-6cwv-x26c-w2q4 · Nota
• https://t.me/cvenotify/5797 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2018-57 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html · Nota
• https://bugs.mageia.org/show_bug.cgi?id=22780 · Nota
• http://openwall.com/lists/oss-security/2018/03/15/2 · Nota
• https://osv.dev/vulnerability/USN-4855-1 · Aviso do Fabricante