Vulnerabilities for jupyterhub

First version without a known vulnerability: 5.4.5

Details

• GHSA-m68r-v472-jgq92026-05-05

  JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)

  Fixed in: 5.4.5

• GHSA-3vff-hjqv-m7h82026-04-03

  JupyterHub has an Open Redirect Vulnerability

  Fixed in: 5.4.4

• GHSA-9x4q-3gxw-849f2024-08-08

  JupyterHub has a privilege escalation vulnerability with the `admin:users` scope

  Fixed in: 4.1.6, 5.1.0, 99e2720b0fc626cbeeca3c6337f917fdacfaa428, ff2db557a85b6980f90c3158634bf924063ab8ba

• GHSA-7r3h-4ph8-w38g2024-03-28

  Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing

  Fixed in: 4.1.0

• GHSA-7xx3-qp5w-fw962022-05-24

  Cross-Site Request Forgery in JupyterHub

  Fixed in: 1.2.0b1

• GHSA-cw7p-q79f-m2v72021-11-08

  incomplete JupyterHub logout with simultaneous JupyterLab sessions

  Fixed in: 1.5.0, 5ac9e7f73a6e1020ffddc40321fc53336829fe27

• GHSA-rv62-4pmj-xw6h2019-04-02

  Open Redirect vulnerability in jupyterhub and notebook

  Fixed in: 5.7.8, 0.9.6