CVEvulnerability
CVE-2014-3429
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-08-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
Affected configurations
• opensuse opensuse 13.1
• opensuse opensuse 13.2
• ipython ipython notebook 0.12
• ipython ipython notebook 0.12.1
• ipython ipython notebook 0.13
• ipython ipython notebook 0.13.1
• ipython ipython notebook 0.13.2
• ipython ipython notebook 1.0.0
• ipython ipython notebook 1.1.0
• mageia mageia 3.0
• mageia mageia 4.0
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://advisories.mageia.org/MGASA-2014-0320.html Third Party Advisory
- http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython Press/Media Coverage, Technical Description
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html Third Party Advisory
- http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198 Broken Link
- http://seclists.org/oss-sec/2014/q3/152 Third Party Advisory, VDB Entry
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:160 Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=1119890 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94497 exchange.xforce.ibmcloud.com
- https://github.com/ipython/ipython/pull/4845 Issue Tracking, Patch
- http://advisories.mageia.org/MGASA-2014-0320.html Third Party Advisory
- http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython Press/Media Coverage, Technical Description
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html Third Party Advisory
- http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198 Broken Link
- http://seclists.org/oss-sec/2014/q3/152 Third Party Advisory, VDB Entry
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:160 Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=1119890 Issue Tracking
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94497 exchange.xforce.ibmcloud.com
- https://github.com/ipython/ipython/pull/4845 Issue Tracking, Patch