CVE-2020-26232

2020-11-2421:15:11

Debian Security Bug Tracker

security-tracker.debian.org

jupyter server

open redirect

vulnerability

crafted link

spoofed server

public internet

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

25.8%

JSON

Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.

OSVersionArchitecturePackageVersionFilename
Debian12alljupyter-server< 1.0.7-1jupyter-server_1.0.7-1_all.deb
Debian11alljupyter-server< 1.0.7-1jupyter-server_1.0.7-1_all.deb
Debian999alljupyter-server< 1.0.7-1jupyter-server_1.0.7-1_all.deb
Debian13alljupyter-server< 1.0.7-1jupyter-server_1.0.7-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	jupyter-server	< 1.0.7-1	jupyter-server_1.0.7-1_all.deb
Debian	11	all	jupyter-server	< 1.0.7-1	jupyter-server_1.0.7-1_all.deb
Debian	999	all	jupyter-server	< 1.0.7-1	jupyter-server_1.0.7-1_all.deb
Debian	13	all	jupyter-server	< 1.0.7-1	jupyter-server_1.0.7-1_all.deb