p PatchFirst

CVE-2024-28188

CVE-2024-28188 · jupyter-scheduler's endpoint is missing authentication

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.

CVSS 5.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • jupyter-scheduler

    Versions
    • >= 1.0.0, <= 1.1.5: Affected
    • = 1.2.0: Affected
    • >= 1.3.0, <= 1.8.1: Affected
    • >= 2.0.0, <= 2.5.1: Affected

    No fix published

  • jupyter-scheduler PyPI

    Versions
    • 1.0.0
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 1.1.6

    Update to 1.1.6

  • jupyter-scheduler PyPI

    Versions
    • 1.2.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.2.0, < 1.2.1

    Update to 1.2.1

  • jupyter-scheduler PyPI

    Versions
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.8.0
    • 1.8.1
    Affected ranges
    • ECOSYSTEM: ≥ 1.3.0, < 1.8.2

    Update to 1.8.2

  • jupyter-scheduler PyPI

    Versions
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 2.4.0
    • 2.5.0
    • 2.5.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.5.2

    Update to 2.5.2

  • jupyter-scheduler PyPI

    Versions
    • 1.0.0
    • 1.1.0
    • 1.1.1
    • 1.1.2
    • 1.1.3
    • 1.1.4
    • 1.1.5
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.8.0
    • 1.8.1
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 2.4.0
    • 2.5.0
    • 2.5.1
    Affected ranges
    • ECOSYSTEM: ≥ 1.0.0, < 1.1.6 ∪ ≥ 1.2.0, < 1.2.1 ∪ ≥ 1.3.0, < 1.8.2 ∪ ≥ 2.0.0, < 2.5.2

    Update to 1.1.6; Update to 1.2.1; Update to 1.8.2; Update to 2.5.2

  • jupyter-server Ubuntu:22.04:LTS

    Versions
    • 1.2.2-1
    • 1.13.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyter-server Ubuntu:24.04:LTS

    Versions
    • 1.23.3-1
    • 1.23.3-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyter-server Ubuntu:25.10

    Versions
    • 2.14.2-5
    • 2.15.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyter-server Ubuntu:26.10

    Versions
    • 2.17.0-1
    • 2.20.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyter-server Ubuntu:26.04:LTS

    Versions
    • 2.15.0-1
    • 2.17.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →