CVE-2020-26215

Name	CVE-2020-26215
Description	Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook server could redirect the browser to a different website. All notebook servers are technically affected, however, these maliciously crafted links can only be reasonably made for known notebook server hosts. A link to your notebook server may appear safe, but ultimately redirect to a spoofed server on the public internet. The issue is patched in version 6.1.5.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2477-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jupyter-notebook (PTS)	stretch (security), stretch (lts), stretch	4.2.3-4+deb9u2	fixed
	buster	5.7.8-1	vulnerable
	bullseye	6.2.0-1	fixed
	bookworm	6.4.12-2.2	fixed
	trixie	6.4.13-3	fixed
	sid	6.4.13-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
jupyter-notebook	source	stretch	4.2.3-4+deb9u2		DLA-2477-1
jupyter-notebook	source	(unstable)	6.1.5-1

Notes

[buster] - jupyter-notebook <no-dsa> (Minor issue)
https://github.com/jupyter/notebook/security/advisories/GHSA-c7vm-f5p4-8fqh
https://github.com/jupyter/notebook/commit/2e1c56b0c4a903606d4a2eb13e32409296b9799d