Bug 878497 (CVE-2022-39286)

Summary:	<dev-python/jupyter_core-4.11.2: arbitrary code execution as another user
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	major	CC:	mgorny, python, sci
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B1 [glsa+]
Package list:		Runtime testing required:	---
Bug Depends on:	879963
Bug Blocks:

Description John Helmert III archtester

2022-10-28 02:31:27 UTC

CVE-2022-39286 (https://github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrp):

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

Patch: https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283

"allows one user to run code as another", another unprivileged user or
potentially the root user?

Please stabilize 4.11.2.

Comment 1 John Helmert III archtester

2022-11-06 13:30:59 UTC

Please cleanup

Comment 2 Michał Górny archtester

2022-11-06 15:43:35 UTC

(In reply to John Helmert III from comment #1)
> Please cleanup

It seems to be clean.

Comment 3 John Helmert III archtester

2022-11-06 17:03:46 UTC

Thanks!

Comment 4 John Helmert III archtester

2022-11-22 17:19:59 UTC

GLSA request filed

Comment 5 Larry the Git Cow gentoo-dev

2023-01-11 05:23:03 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=f5b65513c45fa4e74ad48080531fd2a38ed48474

commit f5b65513c45fa4e74ad48080531fd2a38ed48474
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-01-11 05:17:06 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2023-01-11 05:22:05 +0000

    [ GLSA 202301-04 ] jupyter_core: Arbitrary Code Execution
    
    Bug: https://bugs.gentoo.org/878497
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202301-04.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

Comment 6 John Helmert III archtester

2023-01-11 05:25:40 UTC

GLSA released, all done!