Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are
    considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute
    JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and
    NbconvertPostHandler do not set a Content Security Policy to prevent this. (CVE-2018-19351)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5585-1 advisory.

    It was discovered that Jupyter Notebook incorrectly handled certain notebooks. An attacker could possibly     use this issue of lack of Content Security Policy in Nbconvert to perform cross-site scripting (XSS)     attacks on the notebook server. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19351)

    It was discovered that Jupyter Notebook incorrectly handled certain SVG documents. An attacker could     possibly use this issue to perform cross-site scripting (XSS) attacks. This issue only affected Ubuntu     18.04 LTS. (CVE-2018-21030)

    It was discovered that Jupyter Notebook incorrectly filtered certain URLs on the login page. An attacker     could possibly use this issue to perform open-redirect attack. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2019-10255)

    It was discovered that Jupyter Notebook had an incomplete fix for CVE-2019-10255. An attacker could     possibly use this issue to perform open-redirect attack using empty netloc. (CVE-2019-10856)

    It was discovered that Jupyter Notebook incorrectly handled the inclusion of remote pages on Jupyter     server. An attacker could possibly use this issue to perform cross-site script inclusion (XSSI) attacks.
    This issue only affected Ubuntu 18.04 LTS. (CVE-2019-9644)

    It was discovered that Jupyter Notebook incorrectly filtered certain URLs to a notebook. An attacker could     possibly use this issue to perform open-redirect attack. This issue only affected Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS. (CVE-2020-26215)

    It was discovered that Jupyter Notebook server access logs were not protected. An attacker having access     to the notebook server could possibly use this issue to get access to steal sensitive information such as     auth/cookies. (CVE-2022-24758)

    It was discovered that Jupyter Notebook incorrectly configured hidden files on the server. An     authenticated attacker could possibly use this issue to see unwanted sensitive hidden files from the     server which may result in getting full access to the server. This issue only affected Ubuntu 20.04 LTS     and Ubuntu 22.04 LTS. (CVE-2022-29238)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in jupyter-notebook.

CVE-2018-8768

A maliciously forged notebook file can bypass sanitization to execute JavaScript in the notebook context. Specifically, invalid HTML is 'fixed' by jQuery after sanitization, making it dangerous.

CVE-2018-19351

allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server.

CVE-2018-21030

jupyter-notebook does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.

For Debian 9 stretch, these problems have been fixed in version 4.2.3-4+deb9u1.

We recommend that you upgrade your jupyter-notebook packages.

For the detailed security status of jupyter-notebook please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/jupyter-notebook

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-19351, CVE-2018-19352

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 5.7.2, fix CVE-2018-19351, CVE-2018-19352

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
422825	SCA: security update for notebook (GHSA-49qr-xh3w-h436)	Tenable Cloud Security	SCA Checks	Local	medium
422825	SCA: security update for notebook (GHSA-49qr-xh3w-h436)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
164506	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Jupyter Notebook vulnerabilities (USN-5585-1)	Nessus	Ubuntu Local Security Checks	Local	medium
143107	Debian DLA-2432-1 : jupyter-notebook security update	Nessus	Debian Local Security Checks	Local	high
120736	Fedora 28 : python-notebook (2018-b9581d9624)	Nessus	Fedora Local Security Checks	Local	medium
120730	Fedora 29 : python-notebook (2018-b792d607fd)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2018-19351

medium

Tenable Plugins

medium

medium

medium

high

medium

medium