The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious website. All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix: "jupyter server --ServerApp.base_url=/jupyter/".

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web     applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open     redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious     website. All jupyter servers running without a base_url prefix are technically affected, however, these     maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your     jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This     same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If     upgrade is not available, a workaround can be to run your server on a url prefix: jupyter server
    --ServerApp.base_url=/jupyter/. (CVE-2020-26275)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web
    applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open
    redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious
    website. All jupyter servers running without a base_url prefix are technically affected, however, these
    maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your
    jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This
    same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If
    upgrade is not available, a workaround can be to run your server on a url prefix: "jupyter server
    --ServerApp.base_url=/jupyter/". (CVE-2020-26275)

ID	Name	Product	Family	Severity
256620	Linux Distros Unpatched Vulnerability : CVE-2020-26275	Nessus	Misc.	medium
413236	SCA: security update for jupyter-server (GHSA-9f66-54xg-pc2c)	Tenable Cloud Security	SCA Checks	medium
413236	SCA: security update for jupyter-server (GHSA-9f66-54xg-pc2c)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2020-26275

medium

Tenable Plugins

medium

medium

medium