Bug 2138127 (CVE-2022-39286)

Summary:	CVE-2022-39286 jupyter-core: arbitrary code execution
Product:	[Other] Security Response	Reporter:	ybuenos
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED UPSTREAM	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-jupyter-core 4.11.2	Doc Type:	---
Doc Text:	jupyter core before 4.11.2 contains an arbitrary code execution vulnerability resulting from executing untrusted files in the current working directory, which allows one user to run code as another.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-12-02 22:21:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2138129, 2138128
Bug Blocks:

Description ybuenos 2022-10-27 10:21:56 UTC

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283
https://github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrp

Comment 1 ybuenos 2022-10-27 10:22:16 UTC

Created python-jupyter-core tracking bugs for this issue:

Affects: epel-all [bug 2138129]
Affects: fedora-all [bug 2138128]

Comment 2 Product Security DevOps Team 2022-12-02 22:21:15 UTC

This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.