Ubuntu.comUB:CVE-2018-19351CVE-2018-19351
0.002 Low
EPSS
Percentile
55.5%
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because
nbconvert responses are considered to have the same origin as the notebook
server. In other words, nbconvert endpoints can execute JavaScript with
access to the server API. In notebook/nbconvert/handlers.py,
NbconvertFileHandler and NbconvertPostHandler do not set a Content Security
Policy to prevent this.
Bugs
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | jupyter-notebook | < 5.2.2-1ubuntu0.1 | UNKNOWN |
References
github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
github.com/jupyter/notebook/commit/107a89fce5f413fb5728c1c5d2c7788e1fb17491
groups.google.com/forum/#!topic/jupyter/hWzu2BSsplY
launchpad.net/bugs/cve/CVE-2018-19351
nvd.nist.gov/vuln/detail/CVE-2018-19351
pypi.org/project/notebook/#history
security-tracker.debian.org/tracker/CVE-2018-19351
ubuntu.com/security/notices/USN-5585-1
www.cve.org/CVERecord?id=CVE-2018-19351
Related
