id: PYSEC-2024-165
modified: 2025-01-18T19:19:04.842426Z
published: 2024-06-06T16:15:11Z
aliases:
- CVE-2024-35178
- GHSA-hrw6-wg82-cm62
details: The Jupyter Server provides the backend for Jupyter web applications. Jupyter
  Server on Windows has a vulnerability that lets unauthenticated attackers leak the
  NTLMv2 password hash of the Windows user running the Jupyter server. An attacker
  can crack this password to gain access to the Windows machine hosting the Jupyter
  server, or access other network-accessible machines or 3rd party services using
  that credential. Or an attacker perform an NTLM relay attack without cracking the
  credential to gain access to other network-accessible machines. This vulnerability
  is fixed in 2.14.1.
affected:
- package:
    ecosystem: PyPI
    name: jupyter-server
    purl: pkg:pypi/jupyter-server
  ranges:
  - type: GIT
    events:
    - introduced: "0"
    - fixed: 79fbf801c5908f4d1d9bc90004b74cfaaeeed2df
    repo: https://github.com/jupyter-server/jupyter_server
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.14.1
  versions:
  - 0.0.0
  - 0.0.1
  - 0.0.2
  - 0.0.3
  - 0.0.4
  - 0.0.5
  - 0.1.0
  - 0.1.1
  - 0.2.0
  - 0.2.1
  - 0.3.0
  - 1.0.0
  - 1.0.0rc0
  - 1.0.0rc1
  - 1.0.0rc10
  - 1.0.0rc11
  - 1.0.0rc12
  - 1.0.0rc13
  - 1.0.0rc14
  - 1.0.0rc15
  - 1.0.0rc16
  - 1.0.0rc2
  - 1.0.0rc3
  - 1.0.0rc4
  - 1.0.0rc5
  - 1.0.0rc6
  - 1.0.0rc7
  - 1.0.0rc8
  - 1.0.0rc9
  - 1.0.1
  - 1.0.10
  - 1.0.11
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.0.5
  - 1.0.6
  - 1.0.7
  - 1.0.8
  - 1.0.9
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.10.0
  - 1.10.1
  - 1.10.2
  - 1.11.0
  - 1.11.1
  - 1.11.2
  - 1.12.0
  - 1.12.1
  - 1.13.0
  - 1.13.1
  - 1.13.2
  - 1.13.3
  - 1.13.4
  - 1.13.5
  - 1.15.0
  - 1.15.1
  - 1.15.2
  - 1.15.3
  - 1.15.4
  - 1.15.5
  - 1.15.6
  - 1.16.0
  - 1.17.0
  - 1.17.1
  - 1.18.0
  - 1.18.1
  - 1.19.0
  - 1.19.1
  - 1.2.0
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.21.0
  - 1.23.0
  - 1.23.1
  - 1.23.2
  - 1.23.3
  - 1.23.4
  - 1.23.5
  - 1.23.6
  - 1.24.0
  - 1.3.0
  - 1.4.0
  - 1.4.1
  - 1.5.0
  - 1.5.1
  - 1.6.0
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - 1.7.0
  - 1.7.0a1
  - 1.7.0a2
  - 1.8.0
  - 1.9.0
  - 2.0.0
  - 2.0.0a0
  - 2.0.0a1
  - 2.0.0a2
  - 2.0.0b0
  - 2.0.0b1
  - 2.0.0rc0
  - 2.0.0rc1
  - 2.0.0rc2
  - 2.0.0rc3
  - 2.0.0rc4
  - 2.0.0rc5
  - 2.0.0rc6
  - 2.0.0rc7
  - 2.0.0rc8
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.0.5
  - 2.0.6
  - 2.0.7
  - 2.1.0
  - 2.10.0
  - 2.10.1
  - 2.11.0
  - 2.11.1
  - 2.11.2
  - 2.12.0
  - 2.12.1
  - 2.12.2
  - 2.12.3
  - 2.12.4
  - 2.12.5
  - 2.13.0
  - 2.14.0
  - 2.2.0
  - 2.2.1
  - 2.3.0
  - 2.4.0
  - 2.5.0
  - 2.6.0
  - 2.7.0
  - 2.7.1
  - 2.7.2
  - 2.7.3
  - 2.8.0
  - 2.9.0
  - 2.9.1
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
references:
- type: ADVISORY
  url: 
    https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-hrw6-wg82-cm62
- type: FIX
  url: 
    https://github.com/jupyter-server/jupyter_server/commit/79fbf801c5908f4d1d9bc90004b74cfaaeeed2df
- type: ADVISORY
  url: https://github.com/advisories/GHSA-hrw6-wg82-cm62