CVE-2014-3429: IPython Notebook Remote Code Execution
Summary
CVE-2014-3429: IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page. Affects ipython versions >= 0.12, < 1.2.0. Fixed in 1.2.0. How to fix ↓
Also tracked for
- ipython · Debian:11
The same CVE-2014-3429 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
IPython Notebook is an interactive computational environment for creating and sharing documents containing live code, equations, visualizations, and narrative text. It allows users to create and execute code cells, view the output, and document their work. IPython Notebook versions 0.12 through 1.x before 1.2 are affected by a vulnerability that allows remote attackers to execute arbitrary code. This vulnerability arises from the lack of origin validation in websocket requests, enabling attackers with knowledge of the kernel id and a crafted page to execute arbitrary code on the target system.
Vulnerability Detail
The vulnerability in IPython Notebook arises from the absence of origin validation in websocket requests. This allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page. By exploiting this vulnerability, an attacker can execute arbitrary code on the target system, potentially leading to unauthorized access, data breaches, or further compromise of the affected system.
How To Fix
Minimum fixed version
1.2.0
This is the first release that contains the fix.
pip install --upgrade "ipython==1.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they are using IPython Notebook version 1.2.0 or later, which includes the necessary origin validation for websocket requests.
Conclusion
The vulnerability in IPython Notebook versions 0.12 through 1.x before 1.2 allows remote code execution, posing a significant risk to systems running these versions. To mitigate this risk, it is crucial to upgrade to IPython Notebook version 1.2.0 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ipython →
FAQ
IPython Notebook is an interactive computational environment for creating and sharing documents containing live code, equations, visualizations, and narrative text.
The vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of IPython Notebook. This can lead to unauthorized access, data breaches, or further compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade to IPython Notebook version 1.2.0 or later.
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they are using IPython Notebook version 1.2.0 or later.
For more information about this vulnerability, you can refer to the official advisory at https://github.com/pypa/advisory-database/blob/main/vulns/ipython/PYSEC-2014-21.yaml
Related vulnerabilities
Recent vulnerabilities recorded for ipython.
