id: PYSEC-2020-234
details: Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A
  maliciously crafted link to a jupyter server could redirect the browser to a different
  website. All jupyter servers are technically affected, however, these maliciously
  crafted links can only be reasonably made for known jupyter server hosts. A link
  to your jupyter server may appear safe, but ultimately redirect to a spoofed server
  on the public internet.
affected:
- package:
    name: jupyter-server
    ecosystem: PyPI
    purl: pkg:pypi/jupyter-server
  ranges:
  - type: GIT
    repo: https://github.com/jupyter-server/jupyter_server
    events:
    - introduced: "0"
    - fixed: 3d83e49090289c431da253e2bdb8dc479cbcb157
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.0.6
  versions:
  - 0.0.0
  - 0.0.1
  - 0.0.2
  - 0.0.3
  - 0.0.4
  - 0.0.5
  - 0.1.0
  - 0.1.1
  - 0.2.0
  - 0.2.1
  - 0.3.0
  - 1.0.0
  - 1.0.0rc0
  - 1.0.0rc1
  - 1.0.0rc10
  - 1.0.0rc11
  - 1.0.0rc12
  - 1.0.0rc13
  - 1.0.0rc14
  - 1.0.0rc15
  - 1.0.0rc16
  - 1.0.0rc2
  - 1.0.0rc3
  - 1.0.0rc4
  - 1.0.0rc5
  - 1.0.0rc6
  - 1.0.0rc7
  - 1.0.0rc8
  - 1.0.0rc9
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
references:
- type: ADVISORY
  url: https://github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9v
- type: WEB
  url: https://github.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md#106---2020-11-18
- type: FIX
  url: https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157
aliases:
- CVE-2020-26232
- GHSA-grfj-wjv9-4f9v
modified: "2021-08-27T03:22:05.136094Z"
published: "2020-11-24T21:15:00Z"