jupyterhub/nbgitpuller · Security
Code injection in nbgitpuller
- GHSA ID
- GHSA-mq5p-2mcr-m52j
- CVE ID
- CVE-2021-39160
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v4
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
Impact
Due to an unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment.
Patches
0.10.2
Workarounds
None, other than upgrade to 0.10.2 or downgrade to 0.8.x.
For more information
If you have any questions or comments about this advisory:
- Open an issue in nbgitpuller
- Email our security team at [email protected]
CWEs
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
References
- https://github.com/jupyterhub/nbgitpuller/security/advisories/GHSA-mq5p-2mcr-m52j ↗
- https://nvd.nist.gov/vuln/detail/CVE-2021-39160 ↗
- https://github.com/jupyterhub/nbgitpuller/commit/07690644f29a566011dd0d7ba14cae3eb0490481 ↗
- https://github.com/jupyterhub/nbgitpuller/blob/main/CHANGELOG.md#0102---2021-08-25 ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/nbgitpuller/PYSEC-2021-315.yaml ↗
- https://github.com/advisories/GHSA-mq5p-2mcr-m52j ↗