In breve
- CVE-2021-39160 è una vulnerabilità ALTO (CVSS 8.8) che riguarda nbgitpuller, nbgitpuller (jupyterhub).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.7%, superiore al 77.7% delle vulnerabilità.
- Correzione: aggiornare a 0.10.2 o successiva.
| Package | Affected versions | Patched versions |
|---|
| nbgitpuller PyPI | ≥ 0.9.0, < 0.10.2
| 0.10.2
|
| nbgitpuller | ≥ 0.9.0, < 0.10.2
| 0.10.2
|
Description
Impact
Due to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment.
Patches
0.10.2
Workarounds
None, other than upgrade to 0.10.2 or downgrade to 0.8.x.
For more information
If you have any questions or comments about this advisory:
NVD description
nbgitpuller is a Jupyter server extension to sync a git repository one-way to a local path. Due to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. This has been resolved in version 0.10.2 and all users are advised to upgrade. No work around exist for users who can not upgrade.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free