diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 532d7095b214..9354b8aec71e 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,43 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + Jupyter notebook -- cross-site inclusion (XSSI) vulnerability + + + py27-notebook + py35-notebook + py36-notebook + py37-notebook + 5.7.6 + + + + +

Jupyter notebook Changelog:

+
+

5.7.6 contains a security fix for a cross-site inclusion (XSSI) + vulnerability, where files at a known URL could be included in a page + from an unauthorized website if the user is logged into a Jupyter + server. The fix involves setting the X-Content-Type-Options: nosniff + header, and applying CSRF checks previously on all non-GET API requests + to GET requests to API endpoints and the /files/ endpoint.

+

The attacking page is able to access some contents of files when using + Internet Explorer through script errors, but this has not been + demonstrated with other browsers. A CVE has been requested for this + vulnerability.

+
+ + + + https://github.com/jupyter/notebook/blob/master/docs/source/changelog.rst + + + 2019-03-10 + 2019-03-16 + + + RubyGems -- multiple vulnerabilities