CVE-2022-21697

描述

Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity. Users may upgrade to version 3.2.1 to receive a patch or, as a workaround, install the patch manually.

如何修補 CVE-2022-21697

要修補 CVE-2022-21697,請將受影響套件升級到下列已修補版本。

• —升級至 3.2.1 或更新版本
• —升級至 fd31930bacd12188c448c886e0783529436b99eb 或更新版本

CVE-2022-21697 正在被利用嗎?

低 — EPSS 為 1.1%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 3.2.1
• from 0, < fd31930bacd12188c448c886e0783529436b99eb | from 0, < 3.2.1

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-21697
• WEBgithub.com/jupyterhub/jupyter-server-proxy
• WEBgithub.com/jupyterhub/jupyter-server-proxy/commit/fd31930bacd12188c448c886e0783529436b99eb
• WEBgithub.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch