Description (CNA)
Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyter-scheduler` users maybe be exposed, potentially revealing information about projects that a specific user may be working on. This vulnerability has been patched in version(s) 1.1.6, 1.2.1, 1.8.2 and 2.5.2.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| jupyter-server / jupyter-scheduler | affected >= 1.0.0, <= 1.1.5; affected = 1.2.0; affected >= 1.3.0, <= 1.8.1; affected >= 2.0.0, <= 2.5.1 |
CWE
CWE-200, CWE-287
References
- https://github.com/jupyter-server/jupyter-scheduler/security/advisories/GHSA-v9g2-g7j4-4jxc
- https://github.com/jupyter-server/jupyter_server/pull/1392
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.