CVE-2020-26275: Jupyter Server open redirect vulnerability
(updated )
What kind of vulnerability is it? Who is impacted?
Open redirect vulnerability - a maliciously crafted link to a jupyter server could redirect the browser to a different website.
All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8.
References
- advisory.checkmarx.net/advisory/CX-2020-4291
- github.com/advisories/GHSA-9f66-54xg-pc2c
- github.com/jupyter-server/jupyter_server/commit/85e4abccf6ea9321d29153f73b0bd72ccb3a6bca
- github.com/jupyter-server/jupyter_server/security/advisories/GHSA-9f66-54xg-pc2c
- github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2020-346.yaml
- github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2020-50.yaml
- nvd.nist.gov/vuln/detail/CVE-2020-26275
- pypi.org/project/jupyter-server
Code Behaviors & Features
Detect and mitigate CVE-2020-26275 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →