Candidate: CVE-2020-26215
PublicDate: 2020-11-18 22:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26215
 https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh
 https://github.com/jupyter/notebook/commit/2e1c56b0c4a903606d4a2eb13e32409296b9799d
 https://github.com/jupyter/notebook/commit/3cec4bbe21756de9f0c4bccf18cf61d840314d74
Description:
 Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A
 maliciously crafted link to a notebook server could redirect the browser to
 a different website. All notebook servers are technically affected,
 however, these maliciously crafted links can only be reasonably made for
 known notebook server hosts. A link to your notebook server may appear
 safe, but ultimately redirect to a spoofed server on the public internet.
 The issue is patched in version 6.1.5.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N [6.1 MEDIUM]


Patches_jupyter-notebook:
 upstream: https://github.com/jupyter/notebook/commit/2e1c56b0c4a903606d4a2eb13e32409296b9799d
 upstream: https://github.com/jupyter/notebook/commit/3cec4bbe21756de9f0c4bccf18cf61d840314d74
upstream_jupyter-notebook: released (4.2.3-4+deb9u2, 6.1.5-1)
precise/esm_jupyter-notebook: DNE
trusty_jupyter-notebook: ignored (out of standard support)
trusty/esm_jupyter-notebook: DNE
xenial_jupyter-notebook: DNE
bionic_jupyter-notebook: needed
focal_jupyter-notebook: needed
groovy_jupyter-notebook: ignored (reached end-of-life)
hirsute_jupyter-notebook: not-affected (6.1.5-1ubuntu1)
impish_jupyter-notebook: not-affected (6.1.5-1ubuntu1)
jammy_jupyter-notebook: not-affected (6.1.5-1ubuntu1)
devel_jupyter-notebook: not-affected (6.1.5-1ubuntu1)