CVE-2020-26232: Open redirect in Jupyter Server
(updated )
What kind of vulnerability is it? Who is impacted?
Open redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.
All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
This originated in jupyter/notebook: https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh
References
- github.com/advisories/GHSA-grfj-wjv9-4f9v
- github.com/jupyter-server/jupyter_server
- github.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md
- github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157
- github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9v
- github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2020-234.yaml
- nvd.nist.gov/vuln/detail/CVE-2020-26232
Code Behaviors & Features
Detect and mitigate CVE-2020-26232 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →