PyPI/jupyter-server-proxy CVE-2024-28179: critical 9.8, EPSS 1.03%
Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server
Action: Upgrade jupyter-server-proxy to 3.2.3 or later.
pip install jupyter-server-proxy==3.2.3pip install jupyter-server-proxy==4.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.2.3 | - |
| 4.0.0 | 4.1.1 | - |
Fixed versions
| 3.2.3 | 4.1.1 |
Sources
- osv: PYSEC-2024-234
- https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-w3vc-fx9p-wp4v
- https://github.com/jupyterhub/jupyter-server-proxy/commit/764e499f61a87641916a7a427d4c4b1ac3f321a9
- https://github.com/jupyterhub/jupyter-server-proxy/commit/bead903b7c0354b6efd8b4cde94b89afab653e03
- https://github.com/jupyterhub/jupyter-server-proxy/blob/9b624c4d9507176334b46a85d94a4aa3bcd29bed/jupyter_server_proxy/handlers.py#L433
- https://github.com/advisories/GHSA-w3vc-fx9p-wp4v
CVE-2024-28179 · published · modified · JSON