CVE-2021-41247

published 2021-11-04

CVE-2021-41247: JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser…

Priority P3 39 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I H A N

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	jupyterhub	< jupyterhub 2.0.0+ds1-1 (bookworm)	jupyterhub 2.0.0+ds1-1 (bookworm)
jupyter	jupyterhub	>= 1.0.0 < 1.5.0	1.5.0
jupyterhub	jupyterhub	< 1.2.0 - jupyterhub (helm)	1.2.0 - jupyterhub (helm)
jupyterhub	jupyterhub	—	—
jupyterhub	jupyterhub	>= 0 < 2.0.0+ds1-1	2.0.0+ds1-1
jupyterhub	jupyterhub	>= 0 < 2.0.0+ds1-1	2.0.0+ds1-1
jupyterhub	jupyterhub	>= 0 < 2.0.0+ds1-1	2.0.0+ds1-1
jupyterhub	jupyterhub	>= 1.0.0 < 1.5.0	1.5.0

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:N/I:P/A:N

osv 7.5 HIGH

vendor_debian 3.5 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-613