PT-2020-16345 · Project Jupyter+4 · Jupyter Notebook+4

Zhuonan Li · Published 2020-11-18 · Updated 2024-03-06 · CVE-2020-26215

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jupyter Notebook versions prior to 6.1.5

Description The issue is an open redirect vulnerability, where a maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to a notebook server may appear safe, but ultimately redirect to a spoofed server on the public internet.

Recommendations For versions prior to 6.1.5, update to version 6.1.5 to resolve the issue. As a temporary workaround, consider restricting access to known notebook server hosts to minimize the risk of exploitation. Avoid using links that may appear safe but could ultimately redirect to a spoofed server on the public internet.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2021-2515

BIT-JUPYTER-BASE-NOTEBOOK-2020-26215

BIT-JUPYTER-NOTEBOOK-2020-26215

CVE-2020-26215

DLA-2477-1

GHSA-C7VM-F5P4-8FQH

MGASA-2020-0457

MGASA-2022-0323

OPENSUSE-SU-2021:0024-1

OPENSUSE-SU-2021:0078-1

OPENSUSE-SU-2021:0117-1

OPENSUSE-SU-2021_0024-1

OPENSUSE-SU-2021_0078-1

PYSEC-2020-215

USN-5585-1

Affected Products

Alt Linux

Jupyter Notebook

Linuxmint

Suse

Ubuntu

References · 49

• https://github.com/jupyter/notebook/commit/3cec4bbe21756de9f0c4bccf18cf61d840314d74 · Patch
• https://osv.dev/vulnerability/GHSA-c7vm-f5p4-8fqh · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0024-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5585-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26215 · Security Note
• https://advisories.mageia.org/MGASA-2020-0457.html · Security Note
• https://osv.dev/vulnerability/CVE-2020-26215 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-26215 · Security Note
• https://ubuntu.com/security/CVE-2018-19351 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26215 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-26215 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-21030 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jupyter-base-notebook-2020-26215 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5 · Vendor Advisory