Update dependency notebook to v6.4.12 [SECURITY] #333
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==6.4.6->==6.4.12Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2022-24758
Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.
Upgrade to notebook version 6.4.10
For more information
If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [email protected].
Credit: @3coins for reporting. Thank you!
CVE-2022-29238
Impact
What kind of vulnerability is it? Who is impacted?
Authenticated requests to the notebook server with
ContentsManager.allow_hidden = Falseonly prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed.Because fully authenticated requests are required, this is of relatively low impact. But if a server's root directory contains sensitive files whose only protection from the server is being hidden (e.g.
~/.sshwhile serving $HOME), then any authenticated requests could access files if their names are guessable. Such contexts also necessarily have full access to the server and therefore execution permissions, which also generally grants access to all the same files. So this does not generally result in any privilege escalation or increase in information access, only an additional, unintended means by which the files could be accessed.Patches
Has the problem been patched? What versions should users upgrade to?
notebook 6.4.12
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
self.is_hidden(path)prior to completing actionsReferences
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
Release Notes
jupyter/notebook (notebook)
v6.4.12Compare Source
What's Changed
Full Changelog: jupyter/notebook@v6.4.11...6.4.12
v6.4.11Compare Source
6.4.11
(Full Changelog)
Bugs fixed
Maintenance and upkeep improvements
Contributors to this release
(GitHub contributors page for this release)
@blink1073 | @echarles | @fcollonval | @github-actions | @jtpio | @penguinolog
v6.4.10Compare Source
v6.4.9Compare Source
v6.4.8Compare Source
(Full Changelog)
Bugs fixed
Contributors to this release
(GitHub contributors page for this release)
@Vishwajeet0510
v6.4.7Compare Source
(Full Changelog)
Bugs fixed
Maintenance and upkeep improvements
Other merged PRs
Contributors to this release
(GitHub contributors page for this release)
@antoinecarme | @blink1073 | @ccw630 | @kevin-bates | @LiHua-Official | @penguinolog | @tornaria
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.