Debian/jupyter-notebook: medium 5.3
Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.
Action: Upgrade jupyter-notebook to 5.7.4-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.7.4-1 | - |
Fixed versions
| 5.7.4-1 |
Sources
- osv: DEBIAN-CVE-2018-21030#Debian:14/jupyter-notebook
- https://security-tracker.debian.org/tracker/CVE-2018-21030
published · modified · JSON