id: PYSEC-2022-179
details: The Jupyter Server provides the backend (i.e. the core services, APIs, and
  REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized
  actors can access sensitive information from server logs. Anytime a 5xx error is
  triggered, the auth cookie and other header values are recorded in Jupyter Server
  logs by default. Considering these logs do not require root access, an attacker
  can monitor these logs, steal sensitive auth/cookie information, and gain access
  to the Jupyter server. Jupyter Server version 1.15.4 contains a patch for this issue.
  There are currently no known workarounds.
affected:
- package:
    name: jupyter-server
    ecosystem: PyPI
    purl: pkg:pypi/jupyter-server
  ranges:
  - type: GIT
    repo: https://github.com/jupyter-server/jupyter_server
    events:
    - introduced: "0"
    - fixed: a5683aca0b0e412672ac6218d09f74d44ca0de5a
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.15.4
  versions:
  - 0.0.0
  - 0.0.1
  - 0.0.2
  - 0.0.3
  - 0.0.4
  - 0.0.5
  - 0.1.0
  - 0.1.1
  - 0.2.0
  - 0.2.1
  - 0.3.0
  - 1.0.0
  - 1.0.0rc0
  - 1.0.0rc1
  - 1.0.0rc10
  - 1.0.0rc11
  - 1.0.0rc12
  - 1.0.0rc13
  - 1.0.0rc14
  - 1.0.0rc15
  - 1.0.0rc16
  - 1.0.0rc2
  - 1.0.0rc3
  - 1.0.0rc4
  - 1.0.0rc5
  - 1.0.0rc6
  - 1.0.0rc7
  - 1.0.0rc8
  - 1.0.0rc9
  - 1.0.1
  - 1.0.10
  - 1.0.11
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.0.6
  - 1.0.7
  - 1.0.8
  - 1.0.9
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.10.0
  - 1.10.1
  - 1.10.2
  - 1.11.0
  - 1.11.1
  - 1.11.2
  - 1.12.0
  - 1.12.1
  - 1.13.0
  - 1.13.1
  - 1.13.2
  - 1.13.3
  - 1.13.4
  - 1.13.5
  - 1.15.0
  - 1.15.1
  - 1.15.2
  - 1.15.3
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.3.0
  - 1.4.0
  - 1.4.1
  - 1.5.0
  - 1.5.1
  - 1.6.0
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - 1.7.0
  - 1.7.0a1
  - 1.7.0a2
  - 1.8.0
  - 1.9.0
references:
- type: ADVISORY
  url: https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cpr
- type: FIX
  url: https://github.com/jupyter-server/jupyter_server/commit/a5683aca0b0e412672ac6218d09f74d44ca0de5a
aliases:
- CVE-2022-24757
- GHSA-p737-p57g-4cpr
modified: "2022-04-11T00:47:25.682046Z"
published: "2022-03-23T21:15:00Z"