CVE-2020-26275

Source
https://nvd.nist.gov/vuln/detail/CVE-2020-26275
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26275.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-26275
Aliases
Related
Published
2020-12-21T18:15:15Z
Modified
2025-01-15T01:44:52.919781Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious website. All jupyter servers running without a baseurl prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyterserver 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix: "jupyter server --ServerApp.base_url=/jupyter/".

References

Affected packages

Debian:11 / jupyter-server

Package

Name
jupyter-server
Purl
pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / jupyter-server

Package

Name
jupyter-server
Purl
pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / jupyter-server

Package

Name
jupyter-server
Purl
pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/jupyter-server/jupyter_server

Affected ranges

Type
GIT
Repo
https://github.com/jupyter-server/jupyter_server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed

Affected versions

0.*

0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.1.0
0.1.1
0.2.0
0.3.0

1.*

1.0.0
1.0.0rc1
1.0.0rc10
1.0.0rc11
1.0.0rc12
1.0.0rc13
1.0.0rc14
1.0.0rc15
1.0.0rc16
1.0.0rc2
1.0.0rc3
1.0.0rc4
1.0.0rc5
1.0.0rc6
1.0.0rc7
1.0.0rc8
1.0.0rc9
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.1.0