Catalogue CVE

CVE-2022-24757

jupyter-server affected and fixed versions

[Catalogue CVE]

The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server. Jupyter Server version 1.15.4 contains a patch for this issue. There are currently no known workarounds.

Gravité
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.27% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiejupyter-server1.16.0-1FixedDistribution-reported fixed boundary[CVE-2022-24757]
Debiantrixiejupyter-server2.15.0-1Fixed[CVE-2022-24757]
Debiansidjupyter-server1.16.0-1FixedDistribution-reported fixed boundary[CVE-2022-24757]
Debiansidjupyter-server2.20.0-3Fixed[CVE-2022-24757]
Debianforkyjupyter-server1.16.0-1FixedDistribution-reported fixed boundary[CVE-2022-24757]
Debianforkyjupyter-server2.20.0-3Fixed[CVE-2022-24757]
Debianbookwormjupyter-server1.16.0-1FixedDistribution-reported fixed boundary[CVE-2022-24757]
Debianbookwormjupyter-server1.23.3-1Fixed[CVE-2022-24757]

Showing 8 fix observations. All 10 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormjupyter-server1.16.0-1FixedDistribution-reported fixed boundary[CVE-2022-24757]
Debianbookwormjupyter-server1.23.3-1Fixed[CVE-2022-24757]
Debianforkyjupyter-server1.16.0-1FixedDistribution-reported fixed boundary[CVE-2022-24757]
Debianforkyjupyter-server2.20.0-3Fixed[CVE-2022-24757]
Debiansidjupyter-server1.16.0-1FixedDistribution-reported fixed boundary[CVE-2022-24757]
Debiansidjupyter-server2.20.0-3Fixed[CVE-2022-24757]
Debiantrixiejupyter-server1.16.0-1FixedDistribution-reported fixed boundary[CVE-2022-24757]
Debiantrixiejupyter-server2.15.0-1Fixed[CVE-2022-24757]
Ubuntu22.04jupyter-server1.13.1-1UnknownSource applicability is not established[UBUNTU-CVE-2022-24757]
Ubuntu22.04jupyter-server1.2.2-1UnknownSource applicability is not established[UBUNTU-CVE-2022-24757]
Original provider fields
{
  "package_releases": [
    {
      "name": "jupyter-server",
      "status": "fixed",
      "release": "sid",
      "version": "2.20.0-3"
    },
    {
      "name": "jupyter-server",
      "status": "fixed",
      "release": "forky",
      "version": "2.20.0-3"
    },
    {
      "name": "jupyter-server",
      "status": "fixed",
      "release": "trixie",
      "version": "2.15.0-1"
    },
    {
      "name": "jupyter-server",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.23.3-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1008319,
      "name": "jupyter-server",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.16.0-1"
    },
    {
      "bug": 1008319,
      "name": "jupyter-server",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.16.0-1"
    },
    {
      "bug": 1008319,
      "name": "jupyter-server",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.16.0-1"
    },
    {
      "bug": 1008319,
      "name": "jupyter-server",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.16.0-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "jupyter-server",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "1.2.2-1",
        "1.13.1-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-24757",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-24757",
      "provider_updated_at": "2025-09-08T16:50:03Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1008319]

OpenFactory catalog packages

L’association des paquets est en cours.

[Debian 12 (Bookworm)]

  • [jupyter-server]Inconnu
    Détails (2)

    • 1.23.3-1 · all · bookworm

      Corrigée · Corrigée: 1.16.0-1

      dsa · jupyter-server · debian · bookworm

    • 1.23.3-1 · all · bookworm

      Corrigée · Corrigée: 1.16.0-1

      dsa · jupyter-server · debian · bookworm

  • [python3-jupyter-server]Inconnu

    Paquet source: [jupyter-server]

    Détails (2)

    • 1.23.3-1 · all · bookworm

      Corrigée · Corrigée: 1.16.0-1

      dsa · jupyter-server · debian · bookworm

    • 1.23.3-1 · all · bookworm

      Corrigée · Corrigée: 1.16.0-1

      dsa · jupyter-server · debian · bookworm

Observé:

Références

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]