CVE-2014-3429
medium
CVSS v3
—
CVSS v2
6.8
VIR risk
6.8
Description
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2014-3429
Vendor advisory: cve@mitre.org — https://github.com/ipython/ipython/pull/4845
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| debian | bookworm | fixed | 1.2.0~rc1-1 |
| debian | bullseye | fixed | 1.2.0~rc1-1 |
| debian | forky | fixed | 1.2.0~rc1-1 |
| debian | sid | fixed | 1.2.0~rc1-1 |
| debian | trixie | fixed | 1.2.0~rc1-1 |
| suse | 13.1 | affected | |
| suse | 13.2 | affected | |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| PyPI | ipython | >=0.12,<1.2.0 | 1.2.0 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| ipython | ipython_notebook | 0.12 | |
| ipython | ipython_notebook | 0.12.1 | |
| ipython | ipython_notebook | 0.13 | |
| ipython | ipython_notebook | 0.13.1 | |
| ipython | ipython_notebook | 0.13.2 | |
| ipython | ipython_notebook | 1.0.0 | |
| ipython | ipython_notebook | 1.1.0 | |
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-3429
- https://github.com/ipython/ipython/pull/4845
- https://github.com/ipython/ipython/commit/e5b669ce4750d628dba383fd637dbde918ea15f5
- https://github.com/mattvonrocketstein/ipython/commit/dd4135db9f42d196a46553310a8e63ff5658671d
- https://bugzilla.redhat.com/show_bug.cgi?id=1119890
- https://exchange.xforce.ibmcloud.com/vulnerabilities/94497
- https://github.com/ipython/ipython
- https://github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2014-21.yaml
- http://advisories.mageia.org/MGASA-2014-0320.html
- http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython
- http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html
- http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198
- http://seclists.org/oss-sec/2014/q3/152
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:160
- https://security-tracker.debian.org/tracker/CVE-2014-3429
CWEs
CWE-94
Verify integrity in audit chain (admin only). AS-IS.