[manjaro-security] [ASA-202108-10] jupyterlab: cross-site scripting
Jonas Witschel via arch-security
arch-security at lists.archlinux.org
Fri Aug 13 20:07:14 CEST 2021
Arch Linux Security Advisory ASA-202108-10
==========================================
Severity: High
Date : 2021-08-10
CVE-ID : CVE-2021-32797
Package : jupyterlab
Type : cross-site scripting
Remote : Yes
Link : https://security.archlinux.org/AVG-2266
Summary
=======
The package jupyterlab before version 3.1.4-1 is vulnerable to cross-
site scripting.
Resolution
==========
Upgrade to 3.1.4-1.
# pacman -Syu "jupyterlab>=3.1.4-1"
The problem has been fixed upstream in version 3.1.4.
Workaround
==========
None.
Description
===========
In JupyterLab before version 3.1.4, untrusted notebooks can execute
code on load. In particular JupyterLab doesn't sanitize the action
attribute of the HTML <form> element. Using this it is possible to
trigger the form validation outside of the form itself. This is a
remote code execution, but requires user action to open a notebook.
Impact
======
An attacker could perform remote code execution using a maliciously
crafted notebook file.
References
==========
https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx
https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
https://security.archlinux.org/CVE-2021-32797
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.manjaro.org/pipermail/manjaro-security/attachments/20210813/d261751f/attachment-0001.sig>
More information about the manjaro-security
mailing list