CVE-2022-39286

Description

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

How to fix CVE-2022-39286

To remediate CVE-2022-39286, upgrade the affected package to a fixed version below.

• —upgrade to 4.7.1-1+deb11u1 or later
• —upgrade to 4.4.0-2+deb10u1 or later
• —upgrade to 4.7.1-1+deb11u1 or later
• —upgrade to 4.11.2 or later
• —upgrade to 1118c8ce01800cb689d51f655f5ccef19516e283 or later

Is CVE-2022-39286 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 4.7.1-1+deb11u1
• from 0, < 4.4.0-2+deb10u1
• from 0, < 4.7.1-1+deb11u1
• from 0, < 4.11.2
• from 0, < 1118c8ce01800cb689d51f655f5ccef19516e283 | from 0, < 4.11.2

CVSS scores

References (11)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-39286
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2022-39286
• PATCHgithub.com/jupyter/jupyter_core
• WEBgithub.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283