CVE-2019-10255 Open Redirect vulnerability in jupyterhub and notebook

Medium 6.1 Published 28 Mar 2019 Updated 4 Aug 2024

Crafted links to the login page redirect users to malicious sites after successful login, affecting Jupyter Notebook and Hub installations without a base_url prefix.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-10255?

CVE-2019-10255 is a medium-severity vulnerability in n/a, published on 28 Mar 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.

Weakness: CWE-601

Which versions are affected by CVE-2019-10255?

6 open source packages ship an affected version, including jupyterhub and notebook. It affects 2 products.

Package	Affected	Fixed in
`jupyterhub` PyPI	All versions	`0.9.6`
`jupyterhub` PyPI	All versions	`0.9.6`
`jupyterhub` PyPI	All versions	`0.9.6`
`notebook` PyPI	All versions	`5.7.8`
`notebook` PyPI	All versions	`5.7.8`
`notebook` PyPI	All versions	`5.7.8`

Products include Jupyter Jupyterhub, Jupyter Notebook.

How do I fix CVE-2019-10255?

Upgrade jupyterhub to 0.9.6 or later.

Is CVE-2019-10255 being exploited?

There is no known exploitation of CVE-2019-10255 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2019-10255, GHSA-rv62-4pmj-xw6h, PYSEC-2026-2683, PYSEC-2026-647, UBUNTU-CVE-2019-10255.