CVE-2019-10856 Jupyter Notebook open redirect vulnerability
An open redirect vulnerability in Jupyter Notebook allows attackers to redirect users to malicious sites via an empty netloc.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10856?
CVE-2019-10856 is a medium-severity vulnerability in n/a, published on 4 Apr 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Jupyter Notebook before 5.7.8, an open redirect can occur via an empty netloc. This issue exists because of an incomplete fix for CVE-2019-10255.
Weakness: CWE-601
Which versions are affected by CVE-2019-10856?
3 open source packages ship an affected version, including notebook. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
notebook PyPI | All versions | 5.7.8 |
notebook PyPI | All versions | 5.7.8 |
notebook PyPI | All versions | 5.7.8 |
Products include Jupyter Notebook.
How do I fix CVE-2019-10856?
Upgrade notebook to 5.7.8 or later.
Is CVE-2019-10856 being exploited?
There is no known exploitation of CVE-2019-10856 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-32798 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook
- CVE-2018-8768 Jupyter Notebook file bypasses sanitization, executes JavaScript
- CVE-2022-24758 Insertion of Sensitive Information into Log File affects Jupyter Notebook
- CVE-2018-19351 Jupyter Notebook XSS via untrusted notebooks
- CVE-2018-19352 Jupyter Notebook XSS via directory name
Sources
Also known as GHSA-rcx2-m7jp-p9wj, PYSEC-2019-158, UBUNTU-CVE-2019-10856.