logo

Database

Server side template injection In ipython

Description

IPython Notebook vulnerable to improper validation of the origin of websocket requests IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2014-34292. NVD-2014-34293. OSV-2014-34294. OSV-DEBIAN-2014-34295. GCVE-2014-34296. SECURITY-TRACKER-CVE-2014-3429

References

1. https://github.com/ipython/ipython/pull/48452. https://github.com/ipython/ipython/commit/e5b669ce4750d628dba383fd637dbde918ea15f53. https://github.com/mattvonrocketstein/ipython/commit/dd4135db9f42d196a46553310a8e63ff5658671d4. https://bugzilla.redhat.com/show_bug.cgi?id=11198905. https://exchange.xforce.ibmcloud.com/vulnerabilities/944976. https://github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2014-21.yaml7. http://advisories.mageia.org/MGASA-2014-0320.html8. http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython9. http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html10. http://permalink.gmane.org/gmane.comp.python.ipython.devel/1319811. http://seclists.org/oss-sec/2014/q3/152

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.