CVE-2020-26215 Open redirect in Jupyter Notebook
Attackers can craft links to redirect users from a Jupyter Notebook server to malicious external sites, potentially facilitating phishing attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-26215?
CVE-2020-26215 is a medium-severity vulnerability in Debian Debian Linux, published on 18 Nov 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may appear safe, but ultimately redirect to a spoofed server on the public internet. The issue is patched in version 6.1.5.
Weakness: CWE-601
Which versions are affected by CVE-2020-26215?
5 open source packages ship an affected version, including notebook, jupyter-base-notebook and jupyter-notebook. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
notebook PyPI | All versions | 6.1.5 |
notebook PyPI | All versions | 6.1.5 |
notebook PyPI | All versions | 6.1.5 |
jupyter-base-notebook Bitnami | All versions | 6.1.5 |
jupyter-notebook Bitnami | All versions | 6.1.5 |
Linux distribution packages (3)
python-jupyter_notebook SUSE:Package Hub 15 SP1 | All versions | 5.7.7-bp151.3.3.1 |
python-jupyter_notebook openSUSE:Leap 15.1 | All versions | 5.7.7-lp151.2.3.1 |
python-notebook openSUSE:Leap 15.2 | All versions | 5.7.8-lp152.2.3.1 |
Products include Debian Debian Linux, Jupyter Notebook.
How do I fix CVE-2020-26215?
Upgrade notebook to 6.1.5 or later.
Is CVE-2020-26215 being exploited?
There is no known exploitation of CVE-2020-26215 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-jupyter-base-notebook-2020-26215, BIT-jupyter-notebook-2020-26215, DEBIAN-CVE-2020-26215, DLA-2477-1, GHSA-c7vm-f5p4-8fqh, MGASA-2020-0457 and 5 more.