PyPI/jupyter-server-proxy CVE-2024-35225: critical 9.6, EPSS 0.45%
Jupyter Server Proxy has a reflected XSS issue in host parameter
Action: Upgrade jupyter-server-proxy to 3.2.4 or later.
pip install jupyter-server-proxy==3.2.4pip install jupyter-server-proxy==4.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.2.4 | - |
| 4.0.0 | 4.2.0 | - |
Fixed versions
| 3.2.4 | 4.2.0 |
Sources
- osv: GHSA-fvcq-4x64-hqxr
- https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-fvcq-4x64-hqxr
- https://nvd.nist.gov/vuln/detail/CVE-2024-35225
- https://github.com/jupyterhub/jupyter-server-proxy/commit/7abc9dc5bbb0b4b440548a5375261b8b8192fc22
- https://github.com/jupyterhub/jupyter-server-proxy/commit/ff78128087e73fb9d0909e1366f8bf051e8ea878
- https://github.com/jupyterhub/jupyter-server-proxy
- https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyter_server_proxy/handlers.py#L328
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server-proxy/PYSEC-2024-236.yaml
CVE-2024-35225 · published · modified · JSON