Homepage
About Snyk

jupyterhub@0.9.0b3 vulnerabilities

JupyterHub: A multi-user server for Jupyter notebooks

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the jupyterhub package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Privilege Management

jupyterhub is a JupyterHub: A multi-user server for Jupyter notebooks

Affected versions of this package are vulnerable to Improper Privilege Management in apihandlers/users.py. A high privileged user in the admin:users scope (which is equivalent to admin=True) can escalate to admin privileges by modifying their own grants.

How to fix Improper Privilege Management?

Upgrade jupyterhub to version 4.1.6, 5.1.0 or higher.

[,4.1.6) [5.0.0b1,5.1.0)
  • H
Cross-site Request Forgery (CSRF)

jupyterhub is a JupyterHub: A multi-user server for Jupyter notebooks

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to the mishandling of user input on a malicious subdomain. An attacker can achieve unauthorized access and control over a user's session and potentially gain full access to the JupyterHub API and the user's single-user server by tricking a user into visiting a malicious subdomain.

Note:

This is only exploitable in single-origin JupyterHub deployments and deployments where user-controlled applications run on subdomains or peer subdomains of either the Hub or a single-user server.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade jupyterhub to version 4.1.0 or higher.

[,4.1.0)
  • L
Information Exposure

jupyterhub is a JupyterHub: A multi-user server for Jupyter notebooks

Affected versions of this package are vulnerable to Information Exposure. Users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) are reinstated after logout if another active JupyterLab session is open while the logout takes place.

How to fix Information Exposure?

Upgrade jupyterhub to version 1.5.0 or higher.

[,1.5.0)
  • M
Cross-site Request Forgery (CSRF)

jupyterhub is a JupyterHub: A multi-user server for Jupyter notebooks

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).

How to fix Cross-site Request Forgery (CSRF)?

Upgrade jupyterhub to version 1.2.0b1 or higher.

[0,1.2.0b1)
Go back to all versions of this package