Movatterモバイル変換

Products Openwall GNU/*/Linux  server OS Linux Kernel Runtime Guard John the Ripper  password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists  for password cracking passwdqc  policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt  KDF & password hashing yespower  Proof-of-Work (PoW) crypt_blowfish  password hashing phpass  ditto in PHP tcb  better password shadowing Pluggable Authentication Modules scanlogd  port scan detector popa3d  tiny POP3 daemon blists  web interface to mailing lists msulogin  single user mode login php_mt_seed  mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) File archive & mirrors How to verify digital signatures OVE IDs What's new

Message-ID: <CAHNn8BV_zT_eADA1DGDwQNG2EQQraW0nAe42z5ft+8P=5L5MZw@mail.gmail.com>Date: Wed, 16 Sep 2015 15:02:06 +0200From: MinRK <benjaminrk@...il.com>To: oss-security@...ts.openwall.comCc: security <security@...thon.org>, Kyle Kelley <rgbkrk@...il.com>, Jonathan Kamens <jkamens@...ntopian.com>, Scott Sanderson <ssanderson@...ntopian.com>Subject: CVE Request: Maliciously crafted text files in IPython/Jupyter editorEmail address of requester: security@...thon.org, benjaminrk@...il.com,rgbkrk@...il.com, jkamens@...ntopian.com, ssanderson@...ntopian.comSoftware name: IPython notebook / Jupyter notebookType of vulnerability: Maliciously forged fileAttack outcome: Possible remote executionVulnerability: A maliciously forged file opened for editing can executejavascript, specifically by being redirected to /files/ due to a failure totreat the file as plain text.Affected versions:- IPython 3.0 ≤ version ≤ 3.2.1- notebook 4.0 ≤ 4.0.4URI with issues:- GET /edit/**Patches:- IPython 3.x: 0a8096adf165e2465550bd5893d7e352544e5967 (https://github.com/ipython/ipython/commit/0a8096adf165e2465550bd5893d7e352544e5967)- Jupyter 4.0.x: 9e63dd89b603dfbe3a7e774d8a962ee0fa30c0b5 (https://github.com/jupyter/notebook/commit/9e63dd89b603dfbe3a7e774d8a962ee0fa30c0b5)Mitigations:Upgrade to IPython/Jupyter notebook 4.0.5, 4.1 or 3.2.2 once available.If using pip,    pip install --upgrade "ipython[notebook]<4.0"  # for 3.2.2    pip install --upgrade notebook # for 4.1 or 4.0.5For conda:    conda update conda    conda update ipython "ipython-notebook<4.0" # for 3.2.2    conda update notebook # for 4.1 or 4.0.5Vulnerability reported by Jonathan Kamens at Quantopian

Powered by blists -more mailing lists

Please check out theOpen Source Software Security Wiki, which is counterpart to thismailing list.

Confused aboutmailing lists and their use?Read about mailing lists on Wikipediaand check out theseguidelines on proper formatting of your messages.