Exposure of Sensitive Information to an Unauthorized Actor Affecting jupyter-scheduler package, versions [,1.1.6) [1.2.0,1.2.1) [1.3.0,1.8.2) [2.0.0,2.5.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-JUPYTERSCHEDULER-7018745
- published 23 May 2024
- disclosed 23 May 2024
- credit krassowski
Introduced: 23 May 2024
CVE-2024-28188 Open this link in a new tabHow to fix?
Upgrade jupyter-scheduler to version 1.1.6, 1.2.1, 1.8.2, 2.5.2 or higher.
Overview
jupyter-scheduler is an A JupyterLab extension for running notebook jobs
Affected versions of this package are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor due to improper authentication check on the endpoint /scheduler/runtime_environments. Exploiting this vulnerability allows an unauthenticated attacker to obtain the list of Conda environment names on the server
Note
This issue does not allow an unauthenticated third party to read, modify, or enter the Conda environments present on the server where jupyter_scheduler is running. This issue only reveals the list of Conda environment names.
Workaround
Server operators who are unable to upgrade can disable the jupyter-scheduler extension with:
jupyter server extension disable jupyter-scheduler