GitHub Advisoryadvisory · PyPI

GHSA-m87f-39q9-6f55 Sensitive Auth & Cookie data stored in Jupyter server logs

HIGH Published 2022-04-05 Modified 2022-04-05 Official page ↗
Aliases
CVE-2022-24758
Ecosystem
PyPI
Packages
notebook
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2022-04-05

Affected packages

• PyPI notebook: < 6.4.10 → fixed in 6.4.10

Description

Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Upgrade to notebook version 6.4.10 For more information If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [email protected]. Credit: @3coins for reporting. Thank you!

Related

Alias · CVE (1)

  • CVE-2022-24758 The Jupyter notebook is a web-based notebook environment for interactive computing. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References