id: PYSEC-2020-50
details: 'The Jupyter Server provides the backend (i.e. the core services, APIs, and
  REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab,
  and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability
  could cause the jupyter server to redirect the browser to a different malicious
  website. All jupyter servers running without a base_url prefix are technically affected,
  however, these maliciously crafted links can only be reasonably made for known jupyter
  server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect
  to a spoofed server on the public internet. This same vulnerability was patched
  in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If upgrade is
  not available, a workaround can be to run your server on a url prefix: "jupyter
  server --ServerApp.base_url=/jupyter/".'
affected:
- package:
    name: jupyter-server
    ecosystem: PyPI
    purl: pkg:pypi/jupyter-server
  ranges:
  - type: GIT
    repo: https://github.com/jupyter-server/jupyter_server
    events:
    - introduced: "0"
    - fixed: 85e4abccf6ea9321d29153f73b0bd72ccb3a6bca
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.1.1
  versions:
  - 0.0.0
  - 0.0.1
  - 0.0.2
  - 0.0.3
  - 0.0.4
  - 0.0.5
  - 0.1.0
  - 0.1.1
  - 0.2.0
  - 0.2.1
  - 0.3.0
  - 1.0.0rc0
  - 1.0.0rc1
  - 1.0.0rc2
  - 1.0.0rc3
  - 1.0.0rc4
  - 1.0.0rc5
  - 1.0.0rc6
  - 1.0.0rc7
  - 1.0.0rc8
  - 1.0.0rc9
  - 1.0.0rc10
  - 1.0.0rc11
  - 1.0.0rc12
  - 1.0.0rc13
  - 1.0.0rc14
  - 1.0.0rc15
  - 1.0.0rc16
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.0.6
  - 1.0.7
  - 1.0.8
  - 1.0.9
  - 1.0.10
  - 1.0.11
  - 1.1.0
references:
- type: ADVISORY
  url: https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-9f66-54xg-pc2c
- type: PACKAGE
  url: https://pypi.org/project/jupyter-server/
- type: FIX
  url: https://github.com/jupyter-server/jupyter_server/commit/85e4abccf6ea9321d29153f73b0bd72ccb3a6bca
- type: ADVISORY
  url: https://advisory.checkmarx.net/advisory/CX-2020-4291
aliases:
- CVE-2020-26275
- GHSA-9f66-54xg-pc2c
modified: "2021-03-30T19:15:00Z"
published: "2020-12-21T18:15:00Z"