p PatchFirst

CVE-2022-21697

CVE-2022-21697 · SSRF vulnerability (requires authentication)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity. Users may upgrade to version 3.2.1 to receive a patch or, as a workaround, install the patch manually.

CVSS 6.3 · Medium · EPSS 1.1% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • jupyter-server-proxy

    Versions
    • < 3.2.1: Affected

    No fix published

  • jupyter-server-proxy PyPI

    Versions
    • 1.0
    • 1.0.1
    • 1.0b1
    • 1.0b2
    • 1.0b4
    • 1.0b5
    • 1.0b6
    • 1.0b7
    • 1.0b8
    • 1.0b9
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.5.0
    • 1.5.2
    • 1.5.3
    • 1.6.0
    • 3.0.0
    • 3.0.0rc1
    • 3.0.1
    • 3.0.2
    • 3.1.0
    • 3.2.0
    Affected ranges
    • ECOSYSTEM: < 3.2.1

    Update to 3.2.1

  • jupyter-server-proxy PyPI

    Versions
    • 1.0
    • 1.0.1
    • 1.0b1
    • 1.0b2
    • 1.0b4
    • 1.0b5
    • 1.0b6
    • 1.0b7
    • 1.0b8
    • 1.0b9
    • 1.1.0
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.5.0
    • 1.5.2
    • 1.5.3
    • 1.6.0
    • 3.0.0
    • 3.0.0rc1
    • 3.0.1
    • 3.0.2
    • 3.1.0
    • 3.2.0
    Affected ranges
    • GIT: < fd31930bacd12188c448c886e0783529436b99eb
    • ECOSYSTEM: < 3.2.1

    Update to 3.2.1

Original sources

Check your server →