CVE-2020-26215

NameCVE-2020-26215
DescriptionJupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may appear safe, but ultimately redirect to a spoofed server on the public internet. The issue is patched in version 6.1.5.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
jupyter-notebook (PTS)stretch4.2.3-4vulnerable
stretch (security)4.2.3-4+deb9u1vulnerable
buster5.7.8-1vulnerable
bullseye, sid6.1.5-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
jupyter-notebooksource(unstable)6.1.5-1

Notes

https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh
https://github.com/jupyter/notebook/commit/2e1c56b0c4a903606d4a2eb13e32409296b9799d

Search for package or bug name: Reporting problems