CVE-2024-28179
2 advisories.
PyPI/jupyter-server-proxy CVE-2024-28179: critical 9
Jupyter Server Proxy's Websocket Proxying does not require authentication
Action: Upgrade jupyter-server-proxy to 3.2.3 or later.
pip install jupyter-server-proxy==4.1.1pip install jupyter-server-proxy==3.2.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.1.1 | - |
| 0 | 3.2.3 | - |
Fixed versions
| 4.1.1 | 3.2.3 |
Sources
- osv: GHSA-w3vc-fx9p-wp4v
- https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-w3vc-fx9p-wp4v
- https://nvd.nist.gov/vuln/detail/CVE-2024-28179
- https://github.com/jupyterhub/jupyter-server-proxy/commit/764e499f61a87641916a7a427d4c4b1ac3f321a9
- https://github.com/jupyterhub/jupyter-server-proxy/commit/bead903b7c0354b6efd8b4cde94b89afab653e03
- https://github.com/jupyterhub/jupyter-server-proxy
- https://github.com/jupyterhub/jupyter-server-proxy/blob/9b624c4d9507176334b46a85d94a4aa3bcd29bed/jupyter_server_proxy/handlers.py#L433
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server-proxy/PYSEC-2024-234.yaml
CVE-2024-28179 · published · modified · JSON
PyPI/jupyter-server-proxy CVE-2024-28179: critical 9.8
Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server
Action: Upgrade jupyter-server-proxy to 3.2.3 or later.
pip install jupyter-server-proxy==3.2.3pip install jupyter-server-proxy==4.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.2.3 | - |
| 4.0.0 | 4.1.1 | - |
Fixed versions
| 3.2.3 | 4.1.1 |
Sources
- osv: PYSEC-2024-234
- https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-w3vc-fx9p-wp4v
- https://github.com/jupyterhub/jupyter-server-proxy/commit/764e499f61a87641916a7a427d4c4b1ac3f321a9
- https://github.com/jupyterhub/jupyter-server-proxy/commit/bead903b7c0354b6efd8b4cde94b89afab653e03
- https://github.com/jupyterhub/jupyter-server-proxy/blob/9b624c4d9507176334b46a85d94a4aa3bcd29bed/jupyter_server_proxy/handlers.py#L433
- https://github.com/advisories/GHSA-w3vc-fx9p-wp4v
CVE-2024-28179 · published · modified · JSON