Kurz gesagt
- CVE-2024-22421 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in jupyterlab, notebook, jupyterlab (jupyter).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.67%, höher als bei 52.0% aller Schwachstellen.
- Abhilfe: auf 4.0.11, 3.6.7, 7.0.7 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| jupyterlab PyPI | ≥ 4.0.0, < 4.0.11< 3.6.7
| 4.0.113.6.7
|
| notebook PyPI | ≥ 7.0.0, < 7.0.7
| 7.0.7
|
| jupyterlab | ≥ 4.0.0, < 4.0.11< 3.6.7
| 4.0.113.6.7
|
| notebook | ≥ 7.0.0, < 7.0.7
| 7.0.7
|
Description
Impact
Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version.
Patches
JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched.
Workarounds
No workaround has been identified, however users should ensure to upgrade jupyter-server to version 2.7.2 or newer which includes a redirect vulnerability fix.
References
Vulnerability reported by user @davwwwx via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
NVD description
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. Users of JupyterLab who click on a malicious link may get their `Authorization` and `XSRFToken` tokens exposed to a third party when running an older `jupyter-server` version. JupyterLab versions 4.1.0b2, 4.0.11, and 3.6.7 are patched. No workaround has been identified, however users should ensure to upgrade `jupyter-server` to version 2.7.2 or newer which includes a redirect vulnerability fix.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free