Safety CI > asmodehn/boken

pyup/update-jupyterlab-1.0.9-to-3.5.1

2 years, 7 months ago

2187c1dd

Update jupyterlab from 1.0.9 to 3.5.1

jupyterlab-git 0.8.1 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

Package

Installed

Affected

Info

jupyterlab-git

0.8.1

<0.32.0

show

Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.

jupyterlab-git

0.8.1

<0.51.1

show

Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-git-0.8.1-to-0.40.1

2 years, 7 months ago

676b3323

Update jupyterlab-git from 0.8.1 to 0.40.1

jupyterlab 1.0.9 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.

pyup/update-jupyterlab-git-0.8.1-to-0.40.0

2 years, 7 months ago

c35a4159

Update jupyterlab-git from 0.8.1 to 0.40.0

jupyterlab 1.0.9 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.

pyup/pin-pytest-asyncio-0.20.2

2 years, 7 months ago

3d7cb398

Pin pytest-asyncio to latest version 0.20.2

jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/pin-pytest-7.2.0

2 years, 8 months ago

d04d7ee1

Pin pytest to latest version 7.2.0

jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-1.0.9-to-3.5.0

2 years, 8 months ago

660d0723

Update jupyterlab from 1.0.9 to 3.5.0

jupyterlab-git 0.8.1 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

Package

Installed

Affected

Info

jupyterlab-git

0.8.1

<0.32.0

show

Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.

jupyterlab-git

0.8.1

<0.51.1

show

Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/pin-pytest-asyncio-0.20.1

2 years, 8 months ago

00d26bc3

Pin pytest-asyncio to latest version 0.20.1

jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/pin-pytest-asyncio-0.20.0

2 years, 8 months ago

a135b2b8

Pin pytest-asyncio to latest version 0.20.0

jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-1.0.9-to-3.4.8

2 years, 9 months ago

dfee94bd

Update jupyterlab from 1.0.9 to 3.4.8

jupyterlab-git 0.8.1 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

Package

Installed

Affected

Info

jupyterlab-git

0.8.1

<0.32.0

show

Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.

jupyterlab-git

0.8.1

<0.51.1

show

Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-git-0.8.1-to-0.39.3

2 years, 9 months ago

ee9a0fc9

Update jupyterlab-git from 0.8.1 to 0.39.3

jupyterlab 1.0.9 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.

pyup/pin-aiohttp-3.8.3

2 years, 9 months ago

9db2560e

Pin aiohttp to latest version 3.8.3

jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/pin-aiohttp-3.8.2

2 years, 9 months ago

c60556ee

Pin aiohttp to latest version 3.8.2

jupyterlab 1.0.9 and jupyterlab-git 0.8.1 have known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-1.0.9-to-3.4.7

2 years, 9 months ago

16b6e78e

Update jupyterlab from 1.0.9 to 3.4.7

jupyterlab-git 0.8.1 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

Package

Installed

Affected

Info

jupyterlab-git

0.8.1

<0.32.0

show

Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.

jupyterlab-git

0.8.1

<0.51.1

show

Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

pyup/update-jupyterlab-git-0.8.1-to-0.39.2

2 years, 10 months ago

e1315672

Update jupyterlab-git from 0.8.1 to 0.39.2

jupyterlab 1.0.9 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab	1.0.9	<3.1.0b2	show Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.
jupyterlab	1.0.9	<3.0.8	show Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.
jupyterlab	1.0.9	<3.1.0	show Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.
jupyterlab	1.0.9	>=3.1.0a0,<3.1.4 , >=3.0.0a0,<3.0.17 , >=2.3.0a0,<2.3.2 , >=2.2.0a0,<2.2.10 , <1.2.21	show Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn’t sanitize the action attribute of html "<form>". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
jupyterlab	1.0.9	>=4.0.0,<=4.0.10 , <=3.6.6	show CVE-2024-22421 is a vulnerability in Jupyter Notebook where clicking a malicious link could expose Authorization and XSRFToken tokens to third parties in older jupyter-server versions. Patched versions include JupyterLab 4.1.0b2, 4.0.11, and 3.6.7. Users are advised to upgrade jupyter-server to version 2.7.2 or newer, which includes a fix for a redirect vulnerability. No other workaround has been identified. https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-44cc-43rp-5947
jupyterlab	1.0.9	<=3.6.7 , >=4.0.0,<=4.2.4	show JupyterLab is vulnerable to HTML injection, leading to DOM Clobbering, which allows attackers to access sensitive data and perform arbitrary actions as the compromised user. This vulnerability occurs when a user opens a malicious notebook with Markdown cells or a Markdown file in JupyterLab.

pyup/update-jupyterlab-1.0.9-to-3.4.6

2 years, 10 months ago

a7890d1b

Update jupyterlab from 1.0.9 to 3.4.6

jupyterlab-git 0.8.1 has known security vulnerabilities.

Package	Installed	Affected	Info
jupyterlab-git	0.8.1	<0.32.0	show Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.
jupyterlab-git	0.8.1	<0.51.1	show Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.

Package

Installed

Affected

Info

jupyterlab-git

0.8.1

<0.32.0

show

Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.

jupyterlab-git

0.8.1

<0.51.1

show

Jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a name that includes a shell command substitution string in the syntax $(<command>). These directory names are allowed in macOS and a majority of Linux distributions. If a user starts jupyter-lab in a parent directory of this inappropriately-named Git repository, opens it, and clicks "Git > Open Git Repository in Terminal" from the menu bar, then the injected command <command> is run in the user's shell without the user's permission. This issue is occurring because when that menu entry is clicked, jupyterlab-git opens the terminal and runs cd <git-repo-path> through the shell to set the current directory. Doing so runs any command substitution strings present in the directory name, which leads to the command injection issue described here. A previous patch provided an incomplete fix.