jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. JupyterLab v3.6.8, v4.2.5 and Jupyter Notebook v7.2.2 have been patched to resolve this issue. Users are advised to upgrade. There is no workaround for the underlying DOM Clobbering susceptibility. However, select plugins can be disabled on deployments which cannot update in a timely fashion to minimise the risk. These are: 1. `@jupyterlab/mathjax-extension:plugin` - users will loose ability to preview mathematical equations. 2. `@jupyterlab/markdownviewer-extension:plugin` - users will loose ability to open Markdown previews. 3. `@jupyterlab/mathjax2-extension:plugin` (if installed with optional `jupyterlab-mathjax2` package) - an older version of the mathjax plugin for JupyterLab 4.x. To disable these extensions run: ```jupyter labextension disable @jupyterlab/markdownviewer-extension:plugin && jupyter labextension disable @jupyterlab/mathjax-extension:plugin && jupyter labextension disable @jupyterlab/mathjax2-extension:plugin ``` in bash.

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-4b5f3d51ca advisory.

    Update jupyterlab and python-notebook to fix CVE-2024-43805.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0352-1 advisory.

    - Build the full pacakge with the javascript dependencies as a new       source in vendor.tar.gz.
    - CVE-2024-43805: Fixed data access via malicious Markdown due to HTML injection leading to DOM clobbering     (boo#1229914)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-a3a82a256d advisory.

    Update jupyterlab and python-notebook to fix CVE-2024-43805.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Jupyter Notebook is an extensible environment for interactive and reproducible computing. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211013	Fedora 41 : jupyterlab / python-notebook (2024-4b5f3d51ca)	Nessus	Fedora Local Security Checks	medium
210465	openSUSE 15 Security Update : python-jupyterlab (openSUSE-SU-2024:0352-1)	Nessus	SuSE Local Security Checks	medium
207556	Fedora 40 : jupyterlab / python-jupyterlab-server / python-notebook (2024-a3a82a256d)	Nessus	Fedora Local Security Checks	medium
206722	Jupyter Notebook Python Library < 7.2.2 (CVE-2024-43805)	Nessus	Misc.	medium
206721	Jupyterlab Python Library < 3.6.8, < 4.2.5 (CVE-2024-43805)	Nessus	Misc.	medium

Detections

Analytics

CVE-2024-43805

medium

Tenable Plugins

medium

medium

medium

medium

medium