Medium, CVSS 5.3PyPIAmendedPublished
jupyter-scheduler's endpoint is missing authentication
CVE-2024-28188 · GHSA-v9g2-g7j4-4jxc
- Affected
- PyPI jupyter-scheduler >= 1.0.0, < 1.1.6; >= 1.2.0, <= 1.2.0; >= 1.3.0, < 1.8.2; >= 2.0.0, < 2.5.2
- Fixed in
- 2.5.21.1.61.8.21.2.1· Vendor fix available
- Issue
- Impact jupyterscheduler is missing an authentication check in Jupyter Server on an API endpoint (GET /scheduler/runtimeenvironments) which lists the names of the Conda environments on the server. In affected versions, jupyterscheduler allows an unauthenticated user to obtain the list of Conda environment names on the server. This reveals any information that may be present in a Conda environment name. This issue does not allow an unauthenticated third party to read, modify, or enter the Conda environments present on the server where jupyterscheduler is running. This issue only reveals the list of Conda environment names. Impacted versions: =1.0.0,<=1.1.5 ; ==1.2.0 ; =1.3.0,<=1.8.1 ; =2.0.0,<=2.5.1 Patches jupyter-scheduler==1.1.6 jupyter-scheduler==1.2.1 jupyter-scheduler==1.8.2 jupyter-scheduler==2.5.2 Workarounds Server operators who are unable to upgrade can disable the jupyter-scheduler extension with: References If you have any questions or comments about this advisory we ask…
Recommended action: Upgrade to 2.5.2, 1.8.2, 1.2.1 or 1.1.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.