Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 878497 (CVE-2022-39286) - <dev-python/jupyter_core-4.11.2: arbitrary code execution as another user
Summary: <dev-python/jupyter_core-4.11.2: arbitrary code execution as another user
Status: RESOLVED FIXED
Alias: CVE-2022-39286
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B1 [glsa+]
Keywords:
Depends on: 879963
Blocks:
  Show dependency tree
 
Reported: 2022-10-28 02:31 UTC by John Helmert III
Modified: 2023-01-11 05:25 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-10-28 02:31:27 UTC
CVE-2022-39286 (https://github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrp):

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

Patch: https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283

"allows one user to run code as another", another unprivileged user or
potentially the root user?

Please stabilize 4.11.2.
Comment 1 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-11-06 13:30:59 UTC
Please cleanup
Comment 2 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2022-11-06 15:43:35 UTC
(In reply to John Helmert III from comment #1)
> Please cleanup

It seems to be clean.
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-11-06 17:03:46 UTC
Thanks!
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-11-22 17:19:59 UTC
GLSA request filed
Comment 5 Larry the Git Cow gentoo-dev 2023-01-11 05:23:03 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=f5b65513c45fa4e74ad48080531fd2a38ed48474

commit f5b65513c45fa4e74ad48080531fd2a38ed48474
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-01-11 05:17:06 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2023-01-11 05:22:05 +0000

    [ GLSA 202301-04 ] jupyter_core: Arbitrary Code Execution
    
    Bug: https://bugs.gentoo.org/878497
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202301-04.xml | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
Comment 6 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-01-11 05:25:40 UTC
GLSA released, all done!