The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an authenticated user include traceback information, which can include path information. There is no known mechanism by which to trigger these errors without authentication, so the paths revealed are not considered particularly sensitive, given that the requesting user has arbitrary execution permissions already in the same environment. A fix has been introduced in commit `0056c3aa52` which no longer includes traceback information in JSON error responses. For compatibility, the traceback field is present, but always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web     applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an     authenticated user include traceback information, which can include path information. There is no known     mechanism by which to trigger these errors without authentication, so the paths revealed are not     considered particularly sensitive, given that the requesting user has arbitrary execution permissions     already in the same environment. A fix has been introduced in commit `0056c3aa52` which no longer includes     traceback information in JSON error responses. For compatibility, the traceback field is present, but     always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no     known workarounds for this vulnerability. (CVE-2023-49080)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web
    applications like Jupyter notebook, JupyterLab, and Voila. Unhandled errors in API requests coming from an
    authenticated user include traceback information, which can include path information. There is no known
    mechanism by which to trigger these errors without authentication, so the paths revealed are not
    considered particularly sensitive, given that the requesting user has arbitrary execution permissions
    already in the same environment. A fix has been introduced in commit `0056c3aa52` which no longer includes
    traceback information in JSON error responses. For compatibility, the traceback field is present, but
    always empty. This commit has been included in version 2.11.2. Users are advised to upgrade. There are no
    known workarounds for this vulnerability. (CVE-2023-49080)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-8816029058 advisory.

    Security fix for CVE-2023-49080

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-5beead493f advisory.

    Security fix for CVE-2023-49080 (rhbz#2252897)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
226372	Linux Distros Unpatched Vulnerability : CVE-2023-49080	Nessus	Misc.	Local	medium
415478	SCA: security update for jupyter-server (GHSA-h56g-gq9v-vc8r)	Tenable Cloud Security	SCA Checks	Local	medium
415478	SCA: security update for jupyter-server (GHSA-h56g-gq9v-vc8r)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
186898	Fedora 38 : python-jupyter-server (2023-8816029058)	Nessus	Fedora Local Security Checks	Local	medium
186892	Fedora 39 : python-jupyter-server (2023-5beead493f)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2023-49080

medium

Tenable Plugins

medium

medium

medium

medium

medium