Debian Security Advisory
DLA-2432-1 jupyter-notebook -- LTS security update
- Date Reported:
- 19 Nov 2020
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 893436, Bug 917409.
In Mitre's CVE dictionary: CVE-2018-8768, CVE-2018-19351, CVE-2018-21030.
- More information:
Several vulnerabilities have been discovered in jupyter-notebook.
fixedby jQuery after sanitization, making it dangerous.
allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server.
jupyter-notebook does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.
For Debian 9 stretch, these problems have been fixed in version 4.2.3-4+deb9u1.
We recommend that you upgrade your jupyter-notebook packages.
For the detailed security status of jupyter-notebook please refer to its security tracker page at: https://security-tracker.debian.org/tracker/jupyter-notebook
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS