FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

nothing found there

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
cf39ddf8-21be-11eb-8b47-641c67a117d8jupyter notebook -- open redirect vulnerability

Jupyter reports:

6.1.5 is a security release, fixing one vulnerability: Fix open redirect vulnerability GHSA-c7vm-f5p4-8fqh (CVE to be assigned)

Discovery 2020-10-15
Entry 2020-11-08
lt 6.1.5
fe7e322f-522d-11e9-98b5-216e512dad89Jupyter notebook -- open redirect vulnerability

Jupyter blog:

Login pages tend to take a parameter for redirecting back to a page after successful login, e.g. /login?next=/notebooks/mynotebook.ipynb, so that you aren't disrupted too much if you try to visit a page, but have to authenticate first. An Open Redirect Vulnerability is when a malicious person crafts a link pointing to the login page of a trusted site, but setting the "redirect after successful login" parameter to send the user to their own site, instead of a page on the authenticated site (the notebook or JupyterHub server), e.g. /login?next= This doesn't necessarily compromise anything immediately, but it enables phishing if users don't notice that the domain has changed, e.g. by showing a fake "re-enter your password" page. Servers generally have to validate the redirect URL to avoid this. Both JupyterHub and Notebook already do this, but the validation didn't take into account all possible ways to redirect to other sites, so some malicious URLs could still be crafted to redirect away from the server (the above example does not work in any recent version of either package). Only certain browsers (Chrome and Firefox, not Safari) could be redirected from the JupyterHub login page, but all browsers could be redirected away from a standalone notebook server.

Discovery 2019-03-28
Entry 2019-03-29
Modified 2019-04-06
lt 5.7.8
72a6e3be-483a-11e9-92d7-f1590402501eJupyter notebook -- cross-site inclusion (XSSI) vulnerability

Jupyter notebook Changelog:

5.7.6 contains a security fix for a cross-site inclusion (XSSI) vulnerability, where files at a known URL could be included in a page from an unauthorized website if the user is logged into a Jupyter server. The fix involves setting the X-Content-Type-Options: nosniff header, and applying CSRF checks previously on all non-GET API requests to GET requests to API endpoints and the /files/ endpoint.

The attacking page is able to access some contents of files when using Internet Explorer through script errors, but this has not been demonstrated with other browsers. A CVE has been requested for this vulnerability.

Discovery 2019-03-10
Entry 2019-03-16
lt 5.7.6