PT-2019-10457 · Project Jupyter+2 · Jupyter Notebook+2

Dvandr · Publicado 2019-10-31 · Atualizado 2022-09-10 · CVE-2018-21030

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jupyter Notebook versions prior to 5.5.0

Description The issue arises from the lack of a Content Security Policy (CSP) header, which is used to define what sources of content are allowed to be executed within a web page. Without this header, files served by Jupyter Notebook are not treated as belonging to a separate origin, making them vulnerable to cross-site scripting (XSS) attacks. For instance, an XSS payload can be embedded in an SVG document.

Recommendations For versions prior to 5.5.0, update to version 5.5.0 or later to resolve the issue.

Correção

Incorrect Authorization

XSS

Enumeração de Fraquezas

CWE-863

CWE-79

Identificadores relacionados

CVE-2018-21030

DLA-2432-1

GHSA-JQWC-JM56-WCWJ

MGASA-2022-0323

PYSEC-2019-157

USN-5585-1

Produtos afetados

Jupyter Notebook

Linuxmint

Ubuntu

Referências · 34

• https://github.com/jupyter/notebook · Nota
• https://github.com/jupyter/notebook/pull/3341 · Correção
• https://github.com/jupyter/notebook/security/advisories/GHSA-m87f-39q9-6f55 · Nota
• https://github.com/jupyter/notebook/releases/tag/5.5.0 · Nota
• https://github.com/jupyter/notebook/security/advisories/GHSA-v7vq-3x77-87vg · Nota
• https://github.com/jupyter/notebook/commit/e321c80776542b8d6f3411af16f9e21e51e27687 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2019-157.yaml · Nota
• https://ubuntu.com/security/notices/USN-5585-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jqwc-jm56-wcwj · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-9644 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-21030 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2020/11/msg00033.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-21030 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-21030 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-19351 · Aviso do Fabricante