En bref
- CVE-2021-39160 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant nbgitpuller, nbgitpuller (jupyterhub).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.7%, plus élevée que 77.7% des vulnérabilités.
- Correctif : mettre à jour vers 0.10.2 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| nbgitpuller PyPI | ≥ 0.9.0, < 0.10.2
| 0.10.2
|
| nbgitpuller | ≥ 0.9.0, < 0.10.2
| 0.10.2
|
Description
Impact
Due to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment.
Patches
0.10.2
Workarounds
None, other than upgrade to 0.10.2 or downgrade to 0.8.x.
For more information
If you have any questions or comments about this advisory:
NVD description
nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free