CVE-2020-26232

描述

Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.

如何修補 CVE-2020-26232

要修補 CVE-2020-26232,請將受影響套件升級到下列已修補版本。

• —升級至 1.0.7-1 或更新版本
• —升級至 1.0.6 或更新版本
• —升級至 3d83e49090289c431da253e2bdb8dc479cbcb157 或更新版本

CVE-2020-26232 正在被利用嗎?

低 — EPSS 為 0.8%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0, < 1.0.7-1
• from 0, < 1.0.6
• from 0, < 3d83e49090289c431da253e2bdb8dc479cbcb157 | from 0, < 1.0.6

CVSS 分數

參考連結(7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-26232
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2020-26232
• PATCHgithub.com/jupyter-server/jupyter_server
• WEBgithub.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md#106---2020-11-18