GitHub Advisoryadvisory · PyPI
GHSA-75cw-5cgv-g853 IPython Notebook vulnerable to improper validation of the origin of websocket requests
HIGH
Official page ↗
- Aliases
- CVE-2014-3429
- Ecosystem
- PyPI
- Packages
- ipython
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
- Reviewed
- 2024-04-29
Affected packages
• PyPI ipython: >= 0.12, < 1.2.0 → fixed in 1.2.0
Description
IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
Related
Alias · CVE (1)
- CVE-2014-3429 IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute… vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-3429 advisory
- https://github.com/ipython/ipython/pull/4845 web
- https://github.com/ipython/ipython/commit/e5b669ce4750d628dba383fd637dbde918ea15f5 web
- https://github.com/mattvonrocketstein/ipython/commit/dd4135db9f42d196a46553310a8e63ff5658671d web
- https://bugzilla.redhat.com/show_bug.cgi?id=1119890 web
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94497 web
- https://github.com/ipython/ipython package
- https://github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2014-21.yaml web
- http://advisories.mageia.org/MGASA-2014-0320.html web
- http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython web
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html web
- http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198 web
- http://seclists.org/oss-sec/2014/q3/152 web