Information Exposure Affecting jupyterhub package, versions [,1.5.0)
Threat Intelligence
EPSS
0.07% (33rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-JUPYTERHUB-1912071
- published 5 Nov 2021
- disclosed 5 Nov 2021
- credit Unknown
Introduced: 5 Nov 2021
CVE-2021-41247 Open this link in a new tabHow to fix?
Upgrade jupyterhub to version 1.5.0 or higher.
Overview
jupyterhub is a JupyterHub: A multi-user server for Jupyter notebooks
Affected versions of this package are vulnerable to Information Exposure. Users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) are reinstated after logout if another active JupyterLab session is open while the logout takes place.
References
CVSS Scores
version 3.1