PT-2019-10457 · Project Jupyter+2 · Jupyter Notebook+2

Dvandr · Published 2019-10-31 · Updated 2022-09-10 · CVE-2018-21030

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jupyter Notebook versions prior to 5.5.0

Description The issue arises from the lack of a Content Security Policy (CSP) header, which is used to define what sources of content are allowed to be executed within a web page. Without this header, files served by Jupyter Notebook are not treated as belonging to a separate origin, making them vulnerable to cross-site scripting (XSS) attacks. For instance, an XSS payload can be embedded in an SVG document.

Recommendations For versions prior to 5.5.0, update to version 5.5.0 or later to resolve the issue.

Fix

Incorrect Authorization

XSS

Weakness Enumeration

CWE-863

CWE-79

Related Identifiers

CVE-2018-21030

DLA-2432-1

GHSA-JQWC-JM56-WCWJ

MGASA-2022-0323

PYSEC-2019-157

USN-5585-1

Affected Products

Jupyter Notebook

Linuxmint

Ubuntu

References · 34

• https://github.com/jupyter/notebook/pull/3341 · Patch
• https://ubuntu.com/security/notices/USN-5585-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jqwc-jm56-wcwj · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9644 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-21030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-21030 · Security Note
• https://osv.dev/vulnerability/CVE-2018-21030 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19351 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26215 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-21030 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-21030 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-21030 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2432-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-29238 · Vendor Advisory