CVE-2021-41247: incomplete JupyterHub logout with simultaneous JupyterLab sessions
(updated )
Users of JupyterLab with JupyterHub who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place.
References
- github.com/advisories/GHSA-cw7p-q79f-m2v7
- github.com/jupyterhub/jupyterhub
- github.com/jupyterhub/jupyterhub/commit/5ac9e7f73a6e1020ffddc40321fc53336829fe27
- github.com/jupyterhub/jupyterhub/security/advisories/GHSA-cw7p-q79f-m2v7
- github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2021-386.yaml
- nvd.nist.gov/vuln/detail/CVE-2021-41247
Code Behaviors & Features
Detect and mitigate CVE-2021-41247 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →