Source Package: jupyter-server (1.23.3-1)
Jupyter protocol server backend (Python 3)
The following binary packages are built from this source package:
- python3-jupyter-server
Jupyter protocol server backend (Python 3)
Packages / Debian 12 (Bookworm) / Source / python / jupyter-server
Vulnérabilités connues
L’association des paquets est en cours.
| CVE | Gravité | Impact par version |
|---|---|---|
| [CVE-2026-114135] Published: jupyter-server: CVE-2026-114135 | High(8.8) | InconnuDétails (2)
|
| [CVE-2026-86049] Published: jupyter-server: CVE-2026-86049 | High(7.1) | InconnuDétails (2)
|
| [CVE-2026-44727] Published: Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox d | Critical(9.3) | InconnuDétails (2)
|
| [CVE-2026-6657] Published: A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises from the use of | High(8.8) | InconnuDétails (2)
|
| [CVE-2026-5422] Published: A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.p | High(8.1) | InconnuDétails (2)
|
| [CVE-2026-40934] Published: Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runti | High(7.6) | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
| [CVE-2026-40110] Published: Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the allow_origin_pat | High(7.6) | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
| [CVE-2026-35397] Published: Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_di | High(8.8) | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
| [CVE-2025-61669] Published: Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redi | Medium(6.3) | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
| [CVE-2024-35178] Published: jupyter-server: CVE-2024-35178 | High(7.5) | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
| [CVE-2023-49080] Published: jupyter-server: CVE-2023-49080 | Medium(4.1) | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
| [CVE-2023-39968] Published: jupyter-server: CVE-2023-39968 | Medium(4.3) | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
| [CVE-2023-40170] Published: jupyter-server: CVE-2023-40170 | Medium(6.5) | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
| [CVE-2022-29241] Published: jupyter-server: CVE-2022-29241 | High(8.8) | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
| [CVE-2022-24757] Published: jupyter-server: CVE-2022-24757 | Medium | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
| [CVE-2020-26275] Published: jupyter-server: CVE-2020-26275 | Medium | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
| [CVE-2020-26232] Published: jupyter-server: CVE-2020-26232 | Medium(5.4) | Inconnu L’association des paquets est en cours. Observé: Détails (2)
|
Dernière synchronisation:
Sources
- Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Preuve de signature
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Observed SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Result
- match verified
- Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Preuve de signature
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Observed SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Result
- match verified