CVE-2014-3429 IPython Notebook vulnerable to improper validation of the origin of websocket requests
MediumCVSS 6.8
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi ipython(PyPI) | >= 0.12, < 1.2.0 | 1.2.0 |
| pypi ipython(PyPI) | = 0.12 | No fix listed |
| pypi ipython(PyPI) | = 0.12.1 | No fix listed |
| pypi ipython(PyPI) | = 0.13 | No fix listed |
| pypi ipython(PyPI) | = 0.13.1 | No fix listed |
| pypi ipython(PyPI) | = 0.13.2 | No fix listed |
| pypi ipython(PyPI) | = 1.0.0 | No fix listed |
| pypi ipython(PyPI) | = 1.1.0 | No fix listed |
| debian/ipython(Debian:12) | < 1.2.0~rc1-1 | 1.2.0~rc1-1 |
| debian/ipython(Debian:13) | < 1.2.0~rc1-1 | 1.2.0~rc1-1 |
| debian/ipython(Debian:14) | < 1.2.0~rc1-1 | 1.2.0~rc1-1 |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| ipython notebook | = 0.12 | No fix listed |
| ipython notebook | = 0.12.1 | No fix listed |
| ipython notebook | = 0.13 | No fix listed |
| ipython notebook | = 0.13.1 | No fix listed |
| ipython notebook | = 0.13.2 | No fix listed |
| ipython notebook | = 1.0.0 | No fix listed |
| ipython notebook | = 1.1.0 | No fix listed |
| mageia | = 3.0 | No fix listed |
| mageia | = 4.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking patch
- github.com patch
- github.com patch
- bugzilla.redhat.com issue-tracking
- ipython-cve20143429-code-exec(94497) vdb-entry
- github.com product
- github.com
- advisories.mageia.org third-party-advisory vendor-advisory
- lambdaops.com press-media-coverage technical-description
- openSUSE-SU-2014:1060 third-party-advisory vendor-advisory
- [ipython-dev] 20140713 Vulnerability in IPython Notebook ≤ 1.1 broken-link mailing-list
- [oss-security] 20140715 IPython Notebook Cross 2014-3429 mailing-list third-party-advisory vdb-entry
- MDVSA-2015:160 broken-link vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-3429 vendor-advisory