FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

Jupyter notebook -- cross-site inclusion (XSSI) vulnerability

Affected packages
py27-notebook < 5.7.6
py35-notebook < 5.7.6
py36-notebook < 5.7.6
py37-notebook < 5.7.6

Details

VuXML ID 72a6e3be-483a-11e9-92d7-f1590402501e
Discovery 2019-03-10
Entry 2019-03-16

Jupyter notebook Changelog:

5.7.6 contains a security fix for a cross-site inclusion (XSSI) vulnerability, where files at a known URL could be included in a page from an unauthorized website if the user is logged into a Jupyter server. The fix involves setting the X-Content-Type-Options: nosniff header, and applying CSRF checks previously on all non-GET API requests to GET requests to API endpoints and the /files/ endpoint.

The attacking page is able to access some contents of files when using Internet Explorer through script errors, but this has not been demonstrated with other browsers. A CVE has been requested for this vulnerability.

References

URL https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst
URL https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/pscp-unsanitised-server-output.html
URL https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/side-channels.html
URL https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-auth-prompt-spoofing.html
URL https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-fd-set-overflow.html
URL https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rng-reuse.html
URL https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-rsa-kex-integer-overflow.html
URL https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-combining-chars-double-width-gtk.html
URL https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-combining-chars.html
URL https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-terminal-dos-one-column-cjk.html