PyPI/ipython CVE-2014-3429: critical 9.8, EPSS 4.69%

IPython Notebook vulnerable to improper validation of the origin of websocket requests

Action: Upgrade ipython to 1.2.0 or later.

pip install ipython==1.2.0

Affected

Fixed versions

Sources

• osv: GHSA-75cw-5cgv-g853
• https://nvd.nist.gov/vuln/detail/CVE-2014-3429
• https://github.com/ipython/ipython/pull/4845
• https://github.com/ipython/ipython/commit/e5b669ce4750d628dba383fd637dbde918ea15f5
• https://github.com/mattvonrocketstein/ipython/commit/dd4135db9f42d196a46553310a8e63ff5658671d
• https://bugzilla.redhat.com/show_bug.cgi?id=1119890
• https://exchange.xforce.ibmcloud.com/vulnerabilities/94497
• https://github.com/ipython/ipython
• https://github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2014-21.yaml
• http://advisories.mageia.org/MGASA-2014-0320.html
• http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython
• http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html
• http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198
• http://seclists.org/oss-sec/2014/q3/152

CVE-2014-3429 · published 2022-05-14T02:05:20Z · modified 2024-09-23T17:08:29.475348Z · JSON