CVE-2022-39286 — Vulnetix

CVE-2022-39286 PUBLISHED CVSS 8.800000190734863 HIGH

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

EPSS 0.37% · 59.3th percentile

Risk Scores

CVSS 3.1

8.800000190734863

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.37%

59.3th percentile

Affected Products

Vendor	Product	Versions
PyPI	jupyter-core	0
debian	debian_linux	11.0, 10.0
jupyter	jupyter_core	*, 0
fedoraproject	fedora	36, 37

Exploit Intelligence

https://github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrp (circl)
https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283 (circl)
[debian-lts-announce] 20221117 [SECURITY] [DLA 3195-1] jupyter-core security update (circl)
GLSA-202301-04 (circl)
FEDORA-2023-de87bd076b (circl)
FEDORA-2023-d966145959 (circl)
DSA-5422 (circl)

Timeline

Oct 26, 2022 CVE Published
Oct 27, 2022 EPSS Score
Oct 29, 2022 EPSS Score
Nov 18, 2022 EPSS Score
Jan 22, 2023 EPSS Score
Mar 6, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 19, 2023 EPSS Score
Jun 1, 2023 EPSS Score
Jul 15, 2023 EPSS Score
Oct 10, 2023 EPSS Score
Nov 22, 2023 EPSS Score

References

Open in Interactive Console →