p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in jupyter-notebook

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für jupyter-notebook: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 3

  1. CVE-2022-29238

    Mittel · CVSS 4.3EPSS 1,12%Korrektur verfügbar

    Forced Browsing in Jupyter Notebook

    Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed. Because fully authenticated requests are required, this is of relatively low impact. But if a server's root directory contains sensitive

    jupyter-notebookBetriebssysteme
    • Auf 6.4.8-1ubuntu0.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  2. CVE-2022-24758

    Hoch · CVSS 7.5EPSS 1,11%Korrektur verfügbar

    Insertion of Sensitive Information into Log File affects Jupyter Notebook

    The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds.

    jupyter-notebookBetriebssysteme
    • Auf 6.4.8-1ubuntu0.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →