Homepage
About Snyk

jupyterhub@2.0.0rc5 vulnerabilities

JupyterHub: A multi-user server for Jupyter notebooks

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the jupyterhub package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Privilege Management

jupyterhub is a JupyterHub: A multi-user server for Jupyter notebooks

Affected versions of this package are vulnerable to Improper Privilege Management in apihandlers/users.py. A high privileged user in the admin:users scope (which is equivalent to admin=True) can escalate to admin privileges by modifying their own grants.

How to fix Improper Privilege Management?

Upgrade jupyterhub to version 4.1.6, 5.1.0 or higher.

[,4.1.6) [5.0.0b1,5.1.0)
  • H
Cross-site Request Forgery (CSRF)

jupyterhub is a JupyterHub: A multi-user server for Jupyter notebooks

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) due to the mishandling of user input on a malicious subdomain. An attacker can achieve unauthorized access and control over a user's session and potentially gain full access to the JupyterHub API and the user's single-user server by tricking a user into visiting a malicious subdomain.

Note:

This is only exploitable in single-origin JupyterHub deployments and deployments where user-controlled applications run on subdomains or peer subdomains of either the Hub or a single-user server.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade jupyterhub to version 4.1.0 or higher.

[,4.1.0)
Go back to all versions of this package