The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter notebook version 6.4.x contains a patch for this issue. There are currently no known workarounds.

The version of IBM Cognos Analytics installed on the remote host is affected by multiple vulnerabilities, including the following:

  - OpenSSL is vulnerable to a buffer overflow, caused by improper bounds checking by the EVP_PKEY_decrypt()     function within implementation of the SM2 decryption. By sending specially crafted SM2 content, a remote     attacker could overflow a buffer and execute arbitrary code on the system or cause the application to     crash. (CVE-2021-3711)

  - Async could allow a remote attacker to execute arbitrary code on the system, caused by prototype pollution     in the mapValues() method. By persuading a victim to open a specially-crafted file, an attacker could     exploit this vulnerability to execute arbitrary code on the system.
    (CVE-2021-43138)

  - Apache Commons IO could allow a remote attacker to traverse directories on the system, caused by improper     input validation by the FileNameUtils.normalize method. An attacker could send a specially-crafted URL     request containing 'dot dot' sequences (/../) to view arbitrary files on the system.
    (CVE-2021-29425)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5585-1 advisory.

    It was discovered that Jupyter Notebook incorrectly handled certain notebooks. An attacker could possibly     use this issue of lack of Content Security Policy in Nbconvert to perform cross-site scripting (XSS)     attacks on the notebook server. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19351)

    It was discovered that Jupyter Notebook incorrectly handled certain SVG documents. An attacker could     possibly use this issue to perform cross-site scripting (XSS) attacks. This issue only affected Ubuntu     18.04 LTS. (CVE-2018-21030)

    It was discovered that Jupyter Notebook incorrectly filtered certain URLs on the login page. An attacker     could possibly use this issue to perform open-redirect attack. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2019-10255)

    It was discovered that Jupyter Notebook had an incomplete fix for CVE-2019-10255. An attacker could     possibly use this issue to perform open-redirect attack using empty netloc. (CVE-2019-10856)

    It was discovered that Jupyter Notebook incorrectly handled the inclusion of remote pages on Jupyter     server. An attacker could possibly use this issue to perform cross-site script inclusion (XSSI) attacks.
    This issue only affected Ubuntu 18.04 LTS. (CVE-2019-9644)

    It was discovered that Jupyter Notebook incorrectly filtered certain URLs to a notebook. An attacker could     possibly use this issue to perform open-redirect attack. This issue only affected Ubuntu 18.04 LTS and     Ubuntu 20.04 LTS. (CVE-2020-26215)

    It was discovered that Jupyter Notebook server access logs were not protected. An attacker having access     to the notebook server could possibly use this issue to get access to steal sensitive information such as     auth/cookies. (CVE-2022-24758)

    It was discovered that Jupyter Notebook incorrectly configured hidden files on the server. An     authenticated attacker could possibly use this issue to see unwanted sensitive hidden files from the     server which may result in getting full access to the server. This issue only affected Ubuntu 20.04 LTS     and Ubuntu 22.04 LTS. (CVE-2022-29238)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
166606	IBM Cognos Analytics Multiple Vulnerabilities (6828527)	Nessus	CGI abuses	critical
164506	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Jupyter Notebook vulnerabilities (USN-5585-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2022-24758

high

Tenable Plugins

critical

high