CVE-2019-10255
Publication date 28 March 2019
Last updated 25 August 2025
Ubuntu priority
Description
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| jupyter-notebook | 22.04 LTS jammy |
Not affected
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Fixed 5.2.2-1ubuntu0.1
|
|
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
6.1 · Medium
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Related Ubuntu Security Notices (USN)
- USN-5585-1
- Jupyter Notebook vulnerabilities
- 30 August 2022
Other references
- https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb
- https://github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b
- https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4
- https://github.com/jupyter/notebook/commit/979e0bd15e794ceb00cc63737fcd5fd9addc4a99
- https://www.cve.org/CVERecord?id=CVE-2019-10255