jupyter-server: CVE-2023-40170

Debian Bug report logs - #1057097
jupyter-server: CVE-2023-40170

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: jupyter-server: CVE-2023-40170

Date: Wed, 29 Nov 2023 17:41:44 +0100

Source: jupyter-server
Version: 1.23.3-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: fixed -1 2.9.1-1

Hi,

The following vulnerability was published for jupyter-server.

CVE-2023-40170[0]:
| jupyter-server is the backend for Jupyter web applications. Improper
| cross-site credential checks on `/files/` URLs could allow exposure
| of certain file contents, or accessing files when opening untrusted
| files via  "Open image in new tab". This issue has been addressed in
| commit `87a49272728` which has been included in release `2.7.2`.
| Users are advised to upgrade. Users unable to upgrade may use the
| lower performance `--
| ContentsManager.files_handler_class=jupyter_server.files.handlers.Fi
| lesHandler`, which implements the correct checks.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-40170
    https://www.cve.org/CVERecord?id=CVE-2023-40170
[1] https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-64x5-55rw-9974
[2] https://github.com/jupyter-server/jupyter_server/commit/87a4927272819f0b1cae1afa4c8c86ee2da002fd

Regards,
Salvatore

Send a report that this bug log contains spam.