[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 22 Sep 2015 09:42:07 +0200
From: MinRK <benjaminrk@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: Maliciously crafted text files in IPython/Jupyter editor
Is there any more information needed to get a CVE assignment on this?
-MinRK
On Wed, Sep 16, 2015 at 3:02 PM, MinRK <benjaminrk@...il.com> wrote:
> Email address of requester: security@...thon.org, benjaminrk@...il.com,
> rgbkrk@...il.com, jkamens@...ntopian.com, ssanderson@...ntopian.com
>
> Software name: IPython notebook / Jupyter notebook
> Type of vulnerability: Maliciously forged file
> Attack outcome: Possible remote execution
>
> Vulnerability: A maliciously forged file opened for editing can execute
> javascript, specifically by being redirected to /files/ due to a failure to
> treat the file as plain text.
>
> Affected versions:
>
> - IPython 3.0 ≤ version ≤ 3.2.1
> - notebook 4.0 ≤ 4.0.4
>
> URI with issues:
>
> - GET /edit/**
>
> Patches:
>
> - IPython 3.x: 0a8096adf165e2465550bd5893d7e352544e5967 (
> https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967
> )
> - Jupyter 4.0.x: 9e63dd89b603dfbe3a7e774d8a962ee0fa30c0b5 (
> https://github.com/jupyter/notebook/commit/9e63dd89b603dfbe3a7e774d8a962ee0fa30c0b5
> )
>
> Mitigations:
>
> Upgrade to IPython/Jupyter notebook 4.0.5, 4.1 or 3.2.2 once available.
> If using pip,
>
> pip install --upgrade "ipython[notebook]<4.0" # for 3.2.2
> pip install --upgrade notebook # for 4.1 or 4.0.5
>
> For conda:
>
> conda update conda
> conda update ipython "ipython-notebook<4.0" # for 3.2.2
> conda update notebook # for 4.1 or 4.0.5
>
> Vulnerability reported by Jonathan Kamens at Quantopian
>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
