CVE-2022-24758

Name	CVE-2022-24758
Description	The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1014771

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jupyter-notebook (PTS)	stretch (security), stretch (lts), stretch	4.2.3-4+deb9u2	vulnerable
	buster	5.7.8-1	vulnerable
	bullseye	6.2.0-1	vulnerable
	bookworm	6.4.12-2.2	fixed
	sid, trixie	6.4.13-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
jupyter-notebook	source	stretch	(unfixed)	end-of-life
jupyter-notebook	source	(unstable)	6.4.12-1			1014771

Notes

[bullseye] - jupyter-notebook <no-dsa> (Minor issue)
[buster] - jupyter-notebook <no-dsa> (Minor issue)
https://github.com/jupyter/notebook/security/advisories/GHSA-m87f-39q9-6f55
https://github.com/jupyter/notebook/commit/c219ce43c1ea25123fa70d264e7735bdf4585b1e (6.4.10)