PT-2019-11663 · Project Jupyter+4 · Jupyter Notebook+5

Published 2019-03-28 · Updated 2022-09-10 · CVE-2019-10255

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Jupyter Notebook versions prior to 5.7.7 JupyterHub versions prior to 0.9.5

Description: The issue allows crafted links to the login page to redirect to a malicious site after successful login. This affects all browsers in Jupyter Notebook and some browsers, such as Chrome and Firefox, in JupyterHub. Servers running on a base url prefix are not affected.

Recommendations: For Jupyter Notebook versions prior to 5.7.7, update to version 5.7.7 or later. For JupyterHub versions prior to 0.9.5, update to version 0.9.5 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2019-10255

GHSA-RV62-4PMJ-XW6H

MGASA-2022-0323

OPENSUSE-SU-2024:11242-1

USN-5585-1

Affected Products

Google Chrome

Firefox

Jupyter Notebook

Jupyterhub

Linuxmint

Ubuntu

References · 36

• https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb · Patch
• https://github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b · Patch
• https://github.com/jupyter/notebook/compare/05aa4b2...16cf97c · Patch
• https://github.com/jupyter/notebook/commit/d65328d4841892b412aef9015165db1eb029a8ed · Patch
• https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5585-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9644 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rv62-4pmj-xw6h · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10255 · Security Note
• https://ubuntu.com/security/CVE-2018-19351 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26215 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-21030 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10255 · Vendor Advisory