PT-2018-18623 · Project Jupyter+1 · Jupyter Notebook+1

Published 2018-03-18 · Updated 2021-03-15 · CVE-2018-8768

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jupyter Notebook versions prior to 5.4.1

Description A maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.

Recommendations For versions prior to 5.4.1, update to version 5.4.1 or later to resolve the issue. As a temporary workaround, consider disabling the use of jQuery in the notebook context until a patch is available. Restrict access to maliciously forged notebook files to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2018-8768

DLA-2432-1

GHSA-6CWV-X26C-W2Q4

MGASA-2018-0182

OPENSUSE-SU-2024:11242-1

PYSEC-2018-57

USN-4855-1

Affected Products

Jupyter Notebook

Ubuntu

References · 22

• https://osv.dev/vulnerability/CVE-2018-8768 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0182.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-8768 · Security Note
• https://ubuntu.com/security/notices/USN-4855-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-8768 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-57 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4855-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0182 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6cwv-x26c-w2q4 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-8768 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-8768 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-8768 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-8768 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2432-1 · Vendor Advisory
• https://github.com/jupyter/notebook · Note