Vulnerable Library - Jinja2-2.10.1-py2.py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/1d/e7/fd8b501e7a6dfe492a433deb7b9d833d39ca74916fa8bc63dd1a4947a671/Jinja2-2.10.1-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/Jinja2-2.10.1-py2.py3-none-any/jinja2

Dependency Hierarchy:

• ❌ Jinja2-2.10.1-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, >, or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the xmlattr filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting values as user input continues to be safe. This vulnerability is fixed in 3.1.4.

Publish Date: 2024-05-06

URL: CVE-2024-34064

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-h75v-3vvj-5mfj

Release Date: 2024-05-06

Fix Resolution: Jinja2 - 3.1.4

Vulnerable Library - numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl

Fundamental package for array computing in Python

Library home page: https://files.pythonhosted.org/packages/e1/72/179a78b565ecf01fe98dab6417581d30acac15c2d93c49f93169ebea99b1/numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/2/numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64/numpy

Dependency Hierarchy:

• ❌ numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

** DISPUTED ** A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.

Publish Date: 2021-12-17

URL: CVE-2021-33430

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-33430

Release Date: 2021-12-17

Fix Resolution: 1.21.0

Vulnerable Library - numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl

NumPy is the fundamental package for array computing with Python.

Library home page: https://files.pythonhosted.org/packages/e1/72/179a78b565ecf01fe98dab6417581d30acac15c2d93c49f93169ebea99b1/numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/2/numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64/numpy

Dependency Hierarchy:

• ❌ numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)

Vulnerability Details

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
Mend Note: After conducting further research, Mend has determined that versions 1.12.0 through 1.21.6 of numpy are vulnerable to CVE-2021-34141

Publish Date: 2021-12-17

URL: CVE-2021-34141

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34141

Release Date: 2021-12-17

Fix Resolution: numpy - 1.22.0

Vulnerable Library - nbconvert-5.5.0-py2.py3-none-any.whl

Converting Jupyter Notebooks

Library home page: https://files.pythonhosted.org/packages/35/e7/f46c9d65f149271e47fca6ab084ef5c6e4cb1870f4c5cce6690feac55231/nbconvert-5.5.0-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/notebook-5.7.8-py2.py3-none-any/notebook/nbconvert

Dependency Hierarchy:

• ❌ nbconvert-5.5.0-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

Publish Date: 2022-08-18

URL: CVE-2021-32862

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-9jmq-rx5f-8jwq

Release Date: 2022-08-18

Fix Resolution: nbconvert - 6.3.0

Vulnerable Library - jupyter_core-4.4.0-py2.py3-none-any.whl

Jupyter core package. A base package on which Jupyter projects rely.

Library home page: https://files.pythonhosted.org/packages/1d/44/065d2d7bae7bebc06f1dd70d23c36da8c50c0f08b4236716743d706762a8/jupyter_core-4.4.0-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/jupyter_core-4.4.0-py2.py3-none-any/jupyter_core

Dependency Hierarchy:

• ❌ jupyter_core-4.4.0-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

Publish Date: 2022-10-26

URL: CVE-2022-39286

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3363

Release Date: 2022-10-26

Fix Resolution: 4.11.2

Vulnerable Library - Jinja2-2.10.1-py2.py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/1d/e7/fd8b501e7a6dfe492a433deb7b9d833d39ca74916fa8bc63dd1a4947a671/Jinja2-2.10.1-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/Jinja2-2.10.1-py2.py3-none-any/jinja2

Dependency Hierarchy:

• ❌ Jinja2-2.10.1-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the _punctuation_re regex operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

Publish Date: 2021-02-01

URL: CVE-2020-28493

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28493

Release Date: 2021-02-01

Fix Resolution: Jinja2 - 2.11.3

Vulnerable Library - notebook-5.7.8-py2.py3-none-any.whl

A web-based notebook environment for interactive computing

Library home page: https://files.pythonhosted.org/packages/f6/36/89ebfffc9dd8c8dbd81c1ffb53e3d4233ee666414c143959477cb07cc5f5/notebook-5.7.8-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/notebook-5.7.8-py2.py3-none-any/notebook/notebook

Dependency Hierarchy:

• ❌ notebook-5.7.8-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds.

Publish Date: 2022-03-31

URL: CVE-2022-24758

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-m87f-39q9-6f55

Release Date: 2022-03-31

Fix Resolution: notebook - 6.4.10

Vulnerable Library - nbconvert-5.5.0-py2.py3-none-any.whl

Converting Jupyter Notebooks (.ipynb files) to other formats. Output formats include asciidoc, html, latex, markdown, pdf, py, rst, script. nbconvert can be used both as a Python library (`import nbconvert`) or as a command line tool (invoked as `jupyter nbconvert ...`).

Library home page: https://files.pythonhosted.org/packages/35/e7/f46c9d65f149271e47fca6ab084ef5c6e4cb1870f4c5cce6690feac55231/nbconvert-5.5.0-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/notebook-5.7.8-py2.py3-none-any/notebook/nbconvert

Dependency Hierarchy:

• ❌ nbconvert-5.5.0-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

Publish Date: 2022-08-18

URL: CVE-2021-32862

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-9jmq-rx5f-8jwq

Release Date: 2022-08-18

Fix Resolution: 6.3.0

Vulnerable Library - notebook-5.7.8-py2.py3-none-any.whl

Jupyter Notebook - A web-based notebook environment for interactive computing

Library home page: https://files.pythonhosted.org/packages/f6/36/89ebfffc9dd8c8dbd81c1ffb53e3d4233ee666414c143959477cb07cc5f5/notebook-5.7.8-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/notebook-5.7.8-py2.py3-none-any/notebook/notebook

Dependency Hierarchy:

• ❌ notebook-5.7.8-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may appear safe, but ultimately redirect to a spoofed server on the public internet. The issue is patched in version 6.1.5.

Publish Date: 2020-11-18

URL: CVE-2020-26215

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-c7vm-f5p4-8fqh

Release Date: 2020-11-18

Fix Resolution: 5.7.11

Vulnerable Library - notebook-5.7.8-py2.py3-none-any.whl

A web-based notebook environment for interactive computing

Library home page: https://files.pythonhosted.org/packages/f6/36/89ebfffc9dd8c8dbd81c1ffb53e3d4233ee666414c143959477cb07cc5f5/notebook-5.7.8-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/notebook-5.7.8-py2.py3-none-any/notebook/notebook

Dependency Hierarchy:

• ❌ notebook-5.7.8-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

Publish Date: 2021-08-09

URL: CVE-2021-32798

CVSS 3 Score Details (9.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-hwvq-6gjx-j797

Release Date: 2021-08-09

Fix Resolution: notebook - 5.7.11, 6.4.1

Vulnerable Library - numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl

NumPy is the fundamental package for array computing with Python.

Library home page: https://files.pythonhosted.org/packages/e1/72/179a78b565ecf01fe98dab6417581d30acac15c2d93c49f93169ebea99b1/numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/2/numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64/numpy

Dependency Hierarchy:

• ❌ numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)

Vulnerability Details

** DISPUTED ** A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user.
Mend Note: After conducting further research, Mend has determined that numpy versions before 1.21.0 are vulnerable to CVE-2021-33430

Publish Date: 2021-12-17

URL: CVE-2021-33430

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-33430

Release Date: 2021-12-17

Fix Resolution: numpy - 1.21.0

Vulnerable Library - notebook-5.7.8-py2.py3-none-any.whl

A web-based notebook environment for interactive computing

Library home page: https://files.pythonhosted.org/packages/f6/36/89ebfffc9dd8c8dbd81c1ffb53e3d4233ee666414c143959477cb07cc5f5/notebook-5.7.8-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/notebook-5.7.8-py2.py3-none-any/notebook/notebook

Dependency Hierarchy:

• ❌ notebook-5.7.8-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may appear safe, but ultimately redirect to a spoofed server on the public internet. The issue is patched in version 6.1.5.

Publish Date: 2020-11-18

URL: CVE-2020-26215

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-c7vm-f5p4-8fqh

Release Date: 2020-11-18

Fix Resolution: 6.1.5

Vulnerable Library - Jinja2-2.10.1-py2.py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/1d/e7/fd8b501e7a6dfe492a433deb7b9d833d39ca74916fa8bc63dd1a4947a671/Jinja2-2.10.1-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/Jinja2-2.10.1-py2.py3-none-any/jinja2

Dependency Hierarchy:

• ❌ Jinja2-2.10.1-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the _punctuation_re regex operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

Publish Date: 2021-02-01

URL: CVE-2020-28493

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28493

Release Date: 2021-02-01

Fix Resolution: Jinja2 - 2.11.3

Vulnerable Library - notebook-5.7.8-py2.py3-none-any.whl

A web-based notebook environment for interactive computing

Library home page: https://files.pythonhosted.org/packages/f6/36/89ebfffc9dd8c8dbd81c1ffb53e3d4233ee666414c143959477cb07cc5f5/notebook-5.7.8-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/notebook-5.7.8-py2.py3-none-any/notebook/notebook

Dependency Hierarchy:

• ❌ notebook-5.7.8-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with ContentsManager.allow_hidden = False only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed. Because fully authenticated requests are required, this is of relatively low impact. But if a server's root directory contains sensitive files whose only protection from the server is being hidden (e.g. ~/.ssh while serving $HOME), then any authenticated requests could access files if their names are guessable. Such contexts also necessarily have full access to the server and therefore execution permissions, which also generally grants access to all the same files. So this does not generally result in any privilege escalation or increase in information access, only an additional, unintended means by which the files could be accessed. Version 6.4.12 contains a patch for this issue. There are currently no known workarounds.

Publish Date: 2022-06-14

URL: CVE-2022-29238

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-v7vq-3x77-87vg

Release Date: 2022-06-14

Fix Resolution: notebook - 6.4.12

Vulnerable Library - notebook-5.7.8-py2.py3-none-any.whl

Jupyter Notebook - A web-based notebook environment for interactive computing

Library home page: https://files.pythonhosted.org/packages/f6/36/89ebfffc9dd8c8dbd81c1ffb53e3d4233ee666414c143959477cb07cc5f5/notebook-5.7.8-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/notebook-5.7.8-py2.py3-none-any/notebook/notebook

Dependency Hierarchy:

• ❌ notebook-5.7.8-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with ContentsManager.allow_hidden = False only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed. Because fully authenticated requests are required, this is of relatively low impact. But if a server's root directory contains sensitive files whose only protection from the server is being hidden (e.g. ~/.ssh while serving $HOME), then any authenticated requests could access files if their names are guessable. Such contexts also necessarily have full access to the server and therefore execution permissions, which also generally grants access to all the same files. So this does not generally result in any privilege escalation or increase in information access, only an additional, unintended means by which the files could be accessed. Version 6.4.12 contains a patch for this issue. There are currently no known workarounds.

Publish Date: 2022-06-14

URL: CVE-2022-29238

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-v7vq-3x77-87vg

Release Date: 2022-06-14

Fix Resolution: 5.7.14

Vulnerable Library - numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl

Fundamental package for array computing in Python

Library home page: https://files.pythonhosted.org/packages/e1/72/179a78b565ecf01fe98dab6417581d30acac15c2d93c49f93169ebea99b1/numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/2/numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64/numpy

Dependency Hierarchy:

• ❌ numpy-1.16.3-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."

Publish Date: 2021-12-17

URL: CVE-2021-34141

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34141

Release Date: 2021-12-17

Fix Resolution: 1.22.0

Vulnerable Library - notebook-5.7.8-py2.py3-none-any.whl

Jupyter Notebook - A web-based notebook environment for interactive computing

Library home page: https://files.pythonhosted.org/packages/f6/36/89ebfffc9dd8c8dbd81c1ffb53e3d4233ee666414c143959477cb07cc5f5/notebook-5.7.8-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/notebook-5.7.8-py2.py3-none-any/notebook/notebook

Dependency Hierarchy:

• ❌ notebook-5.7.8-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

Publish Date: 2021-08-09

URL: CVE-2021-32798

CVSS 3 Score Details (9.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-hwvq-6gjx-j797

Release Date: 2021-08-09

Fix Resolution: 5.7.11

Vulnerable Library - Jinja2-2.10.1-py2.py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/1d/e7/fd8b501e7a6dfe492a433deb7b9d833d39ca74916fa8bc63dd1a4947a671/Jinja2-2.10.1-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/Jinja2-2.10.1-py2.py3-none-any/jinja2

Dependency Hierarchy:

• ❌ Jinja2-2.10.1-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja xmlattr filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

Publish Date: 2024-01-11

URL: CVE-2024-22195

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-h5c8-rqwp-cp95

Release Date: 2024-01-11

Fix Resolution: jinja2 - 3.1.3

Vulnerable Library - jupyter_core-4.4.0-py2.py3-none-any.whl

Jupyter core package. A base package on which Jupyter projects rely.

Library home page: https://files.pythonhosted.org/packages/1d/44/065d2d7bae7bebc06f1dd70d23c36da8c50c0f08b4236716743d706762a8/jupyter_core-4.4.0-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/jupyter_core-4.4.0-py2.py3-none-any/jupyter_core

Dependency Hierarchy:

• ❌ jupyter_core-4.4.0-py2.py3-none-any.whl (Vulnerable Library)

Vulnerability Details

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

Publish Date: 2022-10-26

URL: CVE-2022-39286

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3363

Release Date: 2022-10-26

Fix Resolution: jupyter-core - 4.11.2

Vulnerable Library - notebook-5.7.8-py2.py3-none-any.whl

Jupyter Notebook - A web-based notebook environment for interactive computing

Library home page: https://files.pythonhosted.org/packages/f6/36/89ebfffc9dd8c8dbd81c1ffb53e3d4233ee666414c143959477cb07cc5f5/notebook-5.7.8-py2.py3-none-any.whl

Path to dependency file: /ProbStats-with-TFP/requirements.txt

Path to vulnerable library: /teSource-ArchiveExtractor_06502b82-fa31-4507-bcc7-4f2a20df0a9c/20190519121749_57228/20190519121716_depth_0/4/notebook-5.7.8-py2.py3-none-any/notebook/notebook

Dependency Hierarchy:

• ❌ notebook-5.7.8-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds.

Publish Date: 2022-03-31

URL: CVE-2022-24758

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-m87f-39q9-6f55

Release Date: 2022-03-31

Fix Resolution: 5.7.14