PyPI/jupyter-server-proxy CVE-2024-28179: critical 9, EPSS 1.03%
Jupyter Server Proxy's Websocket Proxying does not require authentication
Action: Upgrade jupyter-server-proxy to 3.2.3 or later.
pip install jupyter-server-proxy==4.1.1pip install jupyter-server-proxy==3.2.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.1.1 | - |
| 0 | 3.2.3 | - |
Fixed versions
| 4.1.1 | 3.2.3 |
Sources
- osv: GHSA-w3vc-fx9p-wp4v
- https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-w3vc-fx9p-wp4v
- https://nvd.nist.gov/vuln/detail/CVE-2024-28179
- https://github.com/jupyterhub/jupyter-server-proxy/commit/764e499f61a87641916a7a427d4c4b1ac3f321a9
- https://github.com/jupyterhub/jupyter-server-proxy/commit/bead903b7c0354b6efd8b4cde94b89afab653e03
- https://github.com/jupyterhub/jupyter-server-proxy
- https://github.com/jupyterhub/jupyter-server-proxy/blob/9b624c4d9507176334b46a85d94a4aa3bcd29bed/jupyter_server_proxy/handlers.py#L433
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server-proxy/PYSEC-2024-234.yaml
CVE-2024-28179 · published · modified · JSON