Most recent entries from all

BREW-jupyterlab-CVE-2023-39968 — Open Redirect Vulnerability in jupyter-server

Affected: Homebrew: jupyterlab

### Impact

Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs.

### Patches

Upgrade to Jupyter Server 2.7.2

### Workarounds

None.

### References

Vulnerability reported by user davwwwx via the [bug bounty program](https://app.intigriti.com/programs/jupyter/jupyter/detail) [sponsored by the European Commission](https://commission.europa.eu/news/european-commissions-open-source-programme-office-starts-bug-bounties-2022-01-19_en) and hosted on the [Intigriti platform](https://www.intigriti.com/).

- https://blog.xss.am/2023/08/cve-2023-39968-jupyter-token-leak/

CVE-2023-39968 — Open Redirect Vulnerability in jupyter-server

Affected: jupyter-server jupyter_server

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit `29036259` which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

GHSA-r726-vmfq-j9j3 — Open Redirect Vulnerability in jupyter-server