CVE-2022-39286
High
Description
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Jupyter Core
PublishedOct 26, 2022
First seenOct 26, 2022
Weakness typeCWE-269Improper privilege managementCWE-250CWE-250
How to fix
Update
- jupyter jupyter_core4.11.2 or later
- jupyter-core4.11.2 or later
Vendor advisories
- security.gentoo.org/glsa/202301-04
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDN7JMLK6AOMBQI4QPSW4MBQGWQ5NIN/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KKMP5OXXIX2QAUNVNJZ5UEQFKDYYJVBA/
- debian.org/security/2023/dsa-5422
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jupyter jupyter_core | v < 4.11.2 | 4.11.2 |
| debian debian_linux | 10.0, 11.0 | — |
| fedoraproject fedora | 36, 37 | — |
| jupyter-corePyPI | v < 4.11.2 | 4.11.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.