CVE-2021-41247: falha de baixa gravidade em jupyterhub
incomplete logout in JupyterHub
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.5epss 0.8%
JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
jupyterhub · jupyterhubCVEs relacionadas — jupyterhub
No mesmo produto, das mais perigosas para as menos.
CVE-2024-41942HIGHJupyterHub has a privilege escalation vulnerability with the `admin:users` scopeEPSS 0.6%CVE-2026-54338MEDIUMJupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed LoginEPSS 0.4%CVE-2024-28233HIGHXSS in JupyterHub via Self-XSS leveraged by Cookie TossingEPSS 0.3%CVE-2026-108752LOWJupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped HyphenEPSS 0.2%CVE-2026-33709MEDIUMJupyterHub has an Open Redirect VulnerabilityEPSS 0.2%CVE-2026-40864MEDIUMJupyterHub: Cross-origin form POSTs bypass XSRFEPSS 0.1%