Bug 2067918 (CVE-2022-24757) - CVE-2022-24757 <dev-python/jupyter_server-1.15.6: secret leakage into server logs
Summary: CVE-2022-24757 <dev-python/jupyter_server-1.15.6: secret leakage into server ...
Keywords:
Status: NEW
Alias: CVE-2022-24757
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-03-24 05:11 UTC by Rohit Keshri
Modified: 2023-07-07 08:27 UTC (History)
0 users

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Rohit Keshri 2022-03-24 05:11:58 UTC
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter Server version 1.15.4 contains a patch for this issue. There are currently no known workarounds.

https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cpr
https://github.com/jupyter-server/jupyter_server/commit/a5683aca0b0e412672ac6218d09f74d44ca0de5a


Note You need to log in before you can comment on or make changes to this bug.