8.8
High
CVE-2022-39286 Jupyter Core is a package for the core common functionality of Jupyter projects
Description
Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| jupyter_core 4.11 | earliest → < 4.11.2 | 4.11.2 |
References
- github.com github.com
- github.com github.com
- [debian-lts-announce] 20221117 [SECURITY] [DLA 3195-1] jupyter-core security update lists.debian.org
- GLSA-202301-04 security.gentoo.org
- FEDORA-2023-de87bd076b lists.fedoraproject.org
- FEDORA-2023-d966145959 lists.fedoraproject.org
- DSA-5422 www.debian.org
Timeline
- Published
- Last modified