notebook-6.0.3-py3-none-any.whl: 2 vulnerabilities (highest severity is: 10.0)

[dev-mend-for-github.zerozr99.workers.dev]

Vulnerable Library - notebook-6.0.3-py3-none-any.whl

A web-based notebook environment for interactive computing

Library home page: https://files.pythonhosted.org/packages/b1/f1/0a67f09ef53a342403ffa66646ee39273e0ac79ffa5de5dbe2f3e28b5bdf/notebook-6.0.3-py3-none-any.whl

Path to dependency file: /updater/vendor/cache/python/spec/fixtures/setup_files

Path to vulnerable library: /updater/vendor/cache/python/spec/fixtures/setup_files,/tmp/ws-ua_20250206133952_SYSCJX/python_VQZCGC/202502061425521/env/lib/python3.8/site-packages/notebook-6.0.3.dist-info,/tmp/ws-ua_20250206133952_SYSCJX/python_VQZCGC/202502061427201/env/lib/python3.8/site-packages/notebook-6.0.3.dist-info

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (notebook version)	Remediation Possible**	Reachability
CVE-2021-32798	Critical	10.0	notebook-6.0.3-py3-none-any.whl	Direct	6.4.1	✅
CVE-2020-26215	Medium	4.4	notebook-6.0.3-py3-none-any.whl	Direct	6.1.5	✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-32798

Vulnerable Library - notebook-6.0.3-py3-none-any.whl

A web-based notebook environment for interactive computing

Library home page: https://files.pythonhosted.org/packages/b1/f1/0a67f09ef53a342403ffa66646ee39273e0ac79ffa5de5dbe2f3e28b5bdf/notebook-6.0.3-py3-none-any.whl

Path to dependency file: /updater/vendor/cache/python/spec/fixtures/setup_files

Path to vulnerable library: /updater/vendor/cache/python/spec/fixtures/setup_files,/tmp/ws-ua_20250206133952_SYSCJX/python_VQZCGC/202502061425521/env/lib/python3.8/site-packages/notebook-6.0.3.dist-info,/tmp/ws-ua_20250206133952_SYSCJX/python_VQZCGC/202502061427201/env/lib/python3.8/site-packages/notebook-6.0.3.dist-info

Dependency Hierarchy:

• ❌ notebook-6.0.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

Publish Date: 2021-08-09

URL: CVE-2021-32798

CVSS 3 Score Details (10.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hwvq-6gjx-j797

Release Date: 2021-08-09

Fix Resolution: 6.4.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-26215

Vulnerable Library - notebook-6.0.3-py3-none-any.whl

A web-based notebook environment for interactive computing

Library home page: https://files.pythonhosted.org/packages/b1/f1/0a67f09ef53a342403ffa66646ee39273e0ac79ffa5de5dbe2f3e28b5bdf/notebook-6.0.3-py3-none-any.whl

Path to dependency file: /updater/vendor/cache/python/spec/fixtures/setup_files

Path to vulnerable library: /updater/vendor/cache/python/spec/fixtures/setup_files,/tmp/ws-ua_20250206133952_SYSCJX/python_VQZCGC/202502061425521/env/lib/python3.8/site-packages/notebook-6.0.3.dist-info,/tmp/ws-ua_20250206133952_SYSCJX/python_VQZCGC/202502061427201/env/lib/python3.8/site-packages/notebook-6.0.3.dist-info

Dependency Hierarchy:

• ❌ notebook-6.0.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may appear safe, but ultimately redirect to a spoofed server on the public internet. The issue is patched in version 6.1.5.

Publish Date: 2020-11-18

URL: CVE-2020-26215

CVSS 3 Score Details (4.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c7vm-f5p4-8fqh

Release Date: 2020-11-18

Fix Resolution: 6.1.5

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.