[SECURITY] Fedora 38 Update: nghttp2-1.52.0-3.fc38

This package contains the HTTP/2 client, server and proxy programs...

The vulnerability of the Jupyter Server Proxy software, a tool for launching and proxying web applications, stems from the lack of authentication for a critical function. This allows attackers to execute arbitrary code.

The vulnerability of the Jupyter Server Proxy software for launching and proxying web applications is related to the lack of authentication for a critical function. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Missing Websocket Authentication

Jupyter Server Proxy is vulnerable to Missing Websocket Authentication. The vulnerability is caused due to improper user authentication checks when proxying websockets within handlers.py. This allows an attacker to gain unauthenticated remote access to any websocket endpoint made accessible via t...

grid2viz (>=1.1.0 <=1.3.1), lftakakura-mage-ai (=0.9.37a1) +2 more potentially affected by CVE-2024-28179 via jupyter-server-proxy (>=1.3.2 <=3.2.1)

jupyter-server-proxy PYPI version =1.3.2, =1.1.0, =0.0.6, =0.1.4, =0.2.1 Source cves: CVE-2024-28179 Source advisory: OSV:PYSEC-2024-234...

PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

pydisconet (=0.1.0) potentially affected by CVE-2024-28179 via jupyter-server-proxy (=4.1.0)

jupyter-server-proxy PYPI version =4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server-proxy and may be impacted: - pydisconet =0.1.0 Source cves: CVE-2024-28179 Source advisory: OSV:PYSEC-2024-234...

PYSEC-2024-234

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication

Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server Proxy did not check user authentication appropriately when proxying websockets, allowing...

CVE-2024-28179

CVE-2024-28179 affects the jupyter-server-proxy component prior to versions 3.2.3 and 4.1.1, where websocket proxying did not enforce authentication, enabling unauthenticated remote access to any websocket endpoint exposed via Jupyter Server Proxy. The websocket endpoints provided by jupyter_serv...

GHSA-W3VC-FX9P-WP4V Jupyter Server Proxy's Websocket Proxying does not require authentication

Summary jupyter-server-proxy is used to expose ports local to a Jupyter server listening to web traffic to the Jupyter server's authenticated users by proxying web requests and websockets. Dependent packages partial list also use jupyter-server-proxy to expose other popular interactive applicatio...

Jupyter Server Proxy's Websocket Proxying does not require authentication

Summary jupyter-server-proxy is used to expose ports local to a Jupyter server listening to web traffic to the Jupyter server's authenticated users by proxying web requests and websockets. Dependent packages partial list also use jupyter-server-proxy to expose other popular interactive applicatio...

grid2viz (>=1.1.0 <=1.3.1), lftakakura-mage-ai (=0.9.37a1) +2 more potentially affected by CVE-2024-28179 via jupyter-server-proxy (>=1.3.2 <=3.2.1)

jupyter-server-proxy PYPI version =1.3.2, =1.1.0, =0.0.6, =0.1.4, =0.2.1 Source cves: CVE-2024-28179 Source advisory: OSV:GHSA-W3VC-FX9P-WP4V...

pydisconet (=0.1.0) potentially affected by CVE-2024-28179 via jupyter-server-proxy (=4.1.0)

jupyter-server-proxy PYPI version =4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server-proxy and may be impacted: - pydisconet =0.1.0 Source cves: CVE-2024-28179 Source advisory: OSV:GHSA-W3VC-FX9P-WP4V...

Jupyter Server 安全漏洞

Jupyter Server is an application used by the Jupyter organization to provide back-end services for Jupyter Web applications. A security vulnerability exists in the Jupyter Server Proxy that stems from not properly checking user authentication, which could allow unauthenticated access by anyone wi...

PT-2024-2426 · Unknown · Jupyter Server Proxy

Name of the Vulnerable Software and Affected Versions: Jupyter Server Proxy versions prior to 3.2.3 Jupyter Server Proxy versions prior to 4.1.1 Description: The issue is related to the lack of proper user authentication when proxying websockets in Jupyter Server Proxy. This allows unauthenticate...

SUSE CVE-2023-29450

JavaScript pre-processing can be used by the attacker to gain access to the file system read-only access on behalf of user "zabbix" on the Zabbix Server or Zabbix Proxy, potentially leading to unauthorized access to sensitive data...

SUSE CVE-2005-2088

The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Lengt...