| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| jupyterlab | ≥ 4.0.0, < 4.0.11< 3.6.7 | 4.0.113.6.7 |
| notebook | ≥ 7.0.0, < 7.0.7 | 7.0.7 |
| jupyterlab | ≥ 4.0.0, < 4.0.11< 3.6.7 | 4.0.113.6.7 |
| notebook | ≥ 7.0.0, < 7.0.7 | 7.0.7 |
Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version.
JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched.
No workaround has been identified, however users should ensure to upgrade jupyter-server to version 2.7.2 or newer which includes a redirect vulnerability fix.
Vulnerability reported by user @davwwwx via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí