Log in Start free

Vulnerability · Published Oct 26, 2022 · Assigned by GitHub_M

CVE-2022-39286Execution with Unnecessary Privileges in JupyterApp

High 8.8

In plain English

A high-severity privilege mismanagement in jupyter_core from jupyter. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.4%top 26.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jupyter-core4.11.2-1DEBIAN-CVE-2022-39286
Debian:13jupyter-core4.11.2-1DEBIAN-CVE-2022-39286
Debian:14jupyter-core4.11.2-1DEBIAN-CVE-2022-39286
PyPIjupyter-core4.11.2GHSA-m678-f26j-3hrp
PyPIjupyter-core4.11.2PYSEC-2022-42974

Affected products (as reported)

VendorProductVersions
jupyter jupyter_core < 4.11.2

Weakness: CWE-269, CWE-250 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References