Bug 2235743 (CVE-2023-39968) - CVE-2023-39968 python-jupyter-server: Open Redirect Vulnerability
Summary: CVE-2023-39968 python-jupyter-server: Open Redirect Vulnerability
Keywords:
Status: NEW
Alias: CVE-2023-39968
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2235744 2236245
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-08-29 15:28 UTC by Marian Rehak
Modified: 2023-08-30 19:17 UTC (History)
0 users

Fixed In Version: python-jupyter-server 2.7.2
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Marian Rehak 2023-08-29 15:28:56 UTC 
jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit `29036259` which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

https://github.com/jupyter-server/jupyter_server/commit/290362593b2ffb23c59f8114d76f77875de4b925
https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-r726-vmfq-j9j3
Comment 1 Marian Rehak 2023-08-29 15:29:19 UTC 
Created python-jupyter-server tracking bugs for this issue:

Affects: fedora-38 [bug 2235744]
Note You need to log in before you can comment on or make changes to this bug.