CVE catalog
CVE-2019-10255
jupyter-notebook: CVE-2019-10255
- Severity
- Medium · CVSS 6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.76% · Oct 25, 2026
An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.7 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.5 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | jupyterhub | sid | 5.2.1+ds1-5 | not affected |
| Debian | jupyterhub | forky | 5.2.1+ds1-5 | not affected |
| Debian | jupyterhub | trixie | 5.2.1+ds1-4 | not affected |
| Debian | jupyterhub | bookworm | 3.0.0+ds1-1 | not affected |
| Debian | jupyter-notebook | sid | 7.4.7-3 | fixed |
| Debian | jupyter-notebook | forky | 7.4.7-3 | fixed |
| Debian | jupyter-notebook | trixie | 6.4.13-5 | fixed |
| Debian | jupyter-notebook | bookworm | 6.4.12-2.2 | fixed |
| Ubuntu | jupyter-notebook | 18.04 | 4.2.3-4 | vulnerable |
| Ubuntu | jupyter-notebook | 18.04 | 5.1.0-2 | vulnerable |
| Ubuntu | jupyter-notebook | 18.04 | 5.2.1-2 | vulnerable |
| Ubuntu | jupyter-notebook | 18.04 | 5.2.2-1 | vulnerable |
| Ubuntu | jupyter-notebook | 18.04 | 5.2.2-1ubuntu0.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | jupyterhub | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | jupyterhub | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | jupyterhub | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | jupyterhub | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Debian | jupyter-notebook | source | sid | 5.7.8-1 | not yet assigned | Not reported | [925939] |
| Debian | jupyter-notebook | source | forky | 5.7.8-1 | not yet assigned | Not reported | [925939] |
| Debian | jupyter-notebook | source | trixie | 5.7.8-1 | not yet assigned | Not reported | [925939] |
| Debian | jupyter-notebook | source | bookworm | 5.7.8-1 | not yet assigned | Not reported | [925939] |
| Ubuntu | jupyter-notebook | deb | 18.04 | 5.2.2-1ubuntu0.1 | Not reported | UBUNTU-CVE-2019-10255 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [jupyterhub]Not affected
Details (2)
3.0.0+ds1-1· all · bookwormNot affected
dsa · jupyterhub · debian · bookworm
3.0.0+ds1-1· all · bookwormNot affected
dsa · jupyterhub · debian · bookworm
- [jupyter-notebook]Fixed
Details (2)
6.4.12-2.2· all · bookwormFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · bookworm; dsa · jupyter-notebook · debian · 12
6.4.12-2.2· all · bookwormFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · bookworm; dsa · jupyter-notebook · debian · 12
- [python3-notebook]Fixed
Source package: [jupyter-notebook]
Details (2)
6.4.12-2.2· all · bookwormFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · bookworm; dsa · jupyter-notebook · debian · 12
6.4.12-2.2· all · bookwormFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · bookworm; dsa · jupyter-notebook · debian · 12
- [python-notebook-doc]Fixed
Source package: [jupyter-notebook]
Details (2)
6.4.12-2.2· all · bookwormFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · bookworm; dsa · jupyter-notebook · debian · 12
6.4.12-2.2· all · bookwormFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · bookworm; dsa · jupyter-notebook · debian · 12
[Debian 13 (Trixie)]
- [jupyter-notebook]Fixed
Details (2)
6.4.13-5· all · trixieFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · 13
6.4.13-5· all · trixieFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · 13
- [python3-notebook]Fixed
Source package: [jupyter-notebook]
Details (2)
6.4.13-5· all · trixieFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · 13
6.4.13-5· all · trixieFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · 13
- [python-notebook-doc]Fixed
Source package: [jupyter-notebook]
Details (2)
6.4.13-5· all · trixieFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · 13
6.4.13-5· all · trixieFixed · Fixed:
5.7.8-1dsa · jupyter-notebook · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11242-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2019-10255]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2019-10255]
- [https://security-tracker.debian.org/tracker/CVE-2019-10255]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]