Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed. Because fully authenticated requests are required, this is of relatively low impact. But if a server's root directory contains sensitive files whose only protection from the server is being hidden (e.g. `~/.ssh` while serving $HOME), then any authenticated requests could access files if their names are guessable. Such contexts also necessarily have full access to the server and therefore execution permissions, which also generally grants access to all the same files. So this does not generally result in any privilege escalation or increase in information access, only an additional, unintended means by which the files could be accessed. Version 6.4.12 contains a patch for this issue. There are currently no known workarounds.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12,     authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented     listing the contents of hidden directories, not accessing individual hidden files or files in hidden     directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook     configurations allowing authenticated access to files that may reasonably be expected to be disallowed.
    Because fully authenticated requests are required, this is of relatively low impact. But if a server's     root directory contains sensitive files whose only protection from the server is being hidden (e.g.
    `~/.ssh` while serving $HOME), then any authenticated requests could access files if their names are     guessable. Such contexts also necessarily have full access to the server and therefore execution     permissions, which also generally grants access to all the same files. So this does not generally result     in any privilege escalation or increase in information access, only an additional, unintended means by     which the files could be accessed. Version 6.4.12 contains a patch for this issue. There are currently no     known workarounds. (CVE-2022-29238)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12,
    authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented
    listing the contents of hidden directories, not accessing individual hidden files or files in hidden
    directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook
    configurations allowing authenticated access to files that may reasonably be expected to be disallowed.
    Because fully authenticated requests are required, this is of relatively low impact. But if a server's
    root directory contains sensitive files whose only protection from the server is being hidden (e.g.
    `~/.ssh` while serving $HOME), then any authenticated requests could access files if their names are
    guessable. Such contexts also necessarily have full access to the server and therefore execution
    permissions, which also generally grants access to all the same files. So this does not generally result
    in any privilege escalation or increase in information access, only an additional, unintended means by
    which the files could be accessed. Version 6.4.12 contains a patch for this issue. There are currently no
    known workarounds. (CVE-2022-29238)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5585-1 advisory.

    It was discovered that Jupyter Notebook incorrectly handled certain notebooks. An attacker could possibly     use this issue of lack of Content Security Policy in Nbconvert to perform cross-site scripting (XSS)     attacks on the notebook server. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19351)

    It was discovered that Jupyter Notebook incorrectly handled certain SVG documents. An attacker could     possibly use this issue to perform cross-site scripting (XSS) attacks. This issue only affected Ubuntu     18.04 LTS. (CVE-2018-21030)

    It was discovered that Jupyter Notebook incorrectly filtered certain URLs on the login page. An attacker     could possibly use this issue to perform open-redirect attack. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2019-10255)

    It was discovered that Jupyter Notebook had an incomplete fix for CVE-2019-10255. An attacker could     possibly use this issue to perform open-redirect attack using empty netloc. (CVE-2019-10856)

    It was discovered that Jupyter Notebook incorrectly handled the inclusion of remote pages on Jupyter     server. An attacker could possibly use this issue to perform cross-site script inclusion (XSSI) attacks.
    This issue only affected Ubuntu 18.04 LTS. (CVE-2019-9644)

    It was discovered that Jupyter Notebook incorrectly filtered certain URLs to a notebook. An attacker could     possibly use this issue to perform open-redirect attack. This issue only affected Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS. (CVE-2020-26215)

    It was discovered that Jupyter Notebook server access logs were not protected. An attacker having access     to the notebook server could possibly use this issue to get access to steal sensitive information such as     auth/cookies. (CVE-2022-24758)

    It was discovered that Jupyter Notebook incorrectly configured hidden files on the server. An     authenticated attacker could possibly use this issue to see unwanted sensitive hidden files from the     server which may result in getting full access to the server. This issue only affected Ubuntu 20.04 LTS     and Ubuntu 22.04 LTS. (CVE-2022-29238)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
224626	Linux Distros Unpatched Vulnerability : CVE-2022-29238	Nessus	Misc.	medium
419169	SCA: security update for notebook (GHSA-v7vq-3x77-87vg)	Tenable Cloud Security	SCA Checks	medium
419169	SCA: security update for notebook (GHSA-v7vq-3x77-87vg)	Tenable Self-Hosted Container Security	SCA Checks	medium
405057	Alpine: multiple jupyter-notebook packages: security update to 6.4.12-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
405057	Alpine: multiple jupyter-notebook packages: security update to 6.4.12-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
164506	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Jupyter Notebook vulnerabilities (USN-5585-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2022-29238

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium