CVE-2024-35225
2 advisories.
PyPI/jupyter-server-proxy CVE-2024-35225: critical 9.6, EPSS 0.45%
Jupyter Server Proxy has a reflected XSS issue in host parameter
Action: Upgrade jupyter-server-proxy to 3.2.4 or later.
pip install jupyter-server-proxy==3.2.4pip install jupyter-server-proxy==4.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.2.4 | - |
| 4.0.0 | 4.2.0 | - |
Fixed versions
| 3.2.4 | 4.2.0 |
Sources
- osv: GHSA-fvcq-4x64-hqxr
- https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-fvcq-4x64-hqxr
- https://nvd.nist.gov/vuln/detail/CVE-2024-35225
- https://github.com/jupyterhub/jupyter-server-proxy/commit/7abc9dc5bbb0b4b440548a5375261b8b8192fc22
- https://github.com/jupyterhub/jupyter-server-proxy/commit/ff78128087e73fb9d0909e1366f8bf051e8ea878
- https://github.com/jupyterhub/jupyter-server-proxy
- https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyter_server_proxy/handlers.py#L328
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server-proxy/PYSEC-2024-236.yaml
CVE-2024-35225 · published · modified · JSON
PyPI/jupyter-server-proxy CVE-2024-35225: medium 6.1, EPSS 0.45%
Jupyter Server Proxy allows users to run arbitrary external processes alongside their notebook server and provide authenticated web access to them. Versions of 3.x prior to 3.2.4 and 4.x prior to 4.2.
Action: Upgrade jupyter-server-proxy to 3.2.4 or later.
pip install jupyter-server-proxy==3.2.4pip install jupyter-server-proxy==4.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.2.4 | - |
| 4.1.2 | 4.2.0 | - |
Fixed versions
| 3.2.4 | 4.2.0 |
Sources
- osv: PYSEC-2024-236
- https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-fvcq-4x64-hqxr
- https://github.com/jupyterhub/jupyter-server-proxy/commit/7abc9dc5bbb0b4b440548a5375261b8b8192fc22
- https://github.com/jupyterhub/jupyter-server-proxy/commit/ff78128087e73fb9d0909e1366f8bf051e8ea878
- https://github.com/jupyterhub/jupyter-server-proxy/blob/62a290f08750f7ae55a0c29ca339c9a39a7b2a7b/jupyter_server_proxy/handlers.py#L328
- https://github.com/advisories/GHSA-fvcq-4x64-hqxr
CVE-2024-35225 · published · modified · JSON