incomplete logout in JupyterHub
CVE-2021-41247

3.5LOW

Key Information:

Vendor

Jupyterhub

Status
Jupyterhub
Vendor
CVE Published:
4 November 2021

What is CVE-2021-41247?

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the user environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

jupyterhub >= 1.0.0, < 1.5.0 - jupyterhub (pip) < 1.0.0, 1.5.0 - jupyterhub (pip)

jupyterhub < 1.2.0 - jupyterhub (helm) < 1.2.0 - jupyterhub (helm)

References

https://github.com/jupyterhub/jupyterhub/security/advisor...
x_refsource_CONFIRM
https://github.com/jupyterhub/jupyterhub/commit/5ac9e7f73...
x_refsource_MISC

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.