Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1125937 - ipython: insecure loading of the MathJax library
Summary: ipython: insecure loading of the MathJax library
Keywords:
Status: NEW
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1125938 1125939
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-08-01 11:32 UTC by Martin Prpič
Modified: 2019-09-29 13:20 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Martin Prpič 2014-08-01 11:32:05 UTC 
It was reported [1],[2] that when an IPython notebook is used without encryption (that is, running over HTTP instead of HTTPS), the MathJax library is loaded over HTTP. A man-in-the-middle attacker could potentially use this flaw to execute arbitrary code in a local IPython notebook by modifying the loaded MathJax JavaScript code.

This issue is fixed in the upcoming version 2.2 with the patch available at [3].

The report indicates versions 0.12 to 2.1 are vulnerable to this flaw. The version of IPython shipped with EPEL5 (0.8.4) is not vulnerable to this issue as the vulnerable code that loads MathJax is not present.

[1] https://github.com/ipython/ipython/issues/6246
[2] http://seclists.org/oss-sec/2014/q3/272
[3] https://github.com/ipython/ipython/commit/cf793ebc4f9e8483f104667e4c73748357fa8c56
Comment 1 Martin Prpič 2014-08-01 11:34:31 UTC 
Created ipython tracking bugs for this issue:

Affects: fedora-all [bug 1125938]
Affects: epel-6 [bug 1125939]
Note You need to log in before you can comment on or make changes to this bug.