CVE-2022-24758

The Jupyter notebook is a web-based notebook environment for interactive
computing. Prior to version 6.4.9, unauthorized actors can access sensitive
information from server logs. Anytime a 5xx error is triggered, the auth
cookie and other header values are recorded in Jupyter server logs by
default. Considering these logs do not require root access, an attacker can
monitor these logs, steal sensitive auth/cookie information, and gain
access to the Jupyter server. Jupyter notebook version 6.4.x contains a
patch for this issue. There are currently no known workarounds.

Bugs

• <https://bugs.launchpad.net/ubuntu/+source/jupyter-notebook/+bug/1982670&gt;