DSA-5422: -1 jupyter-core -- security update

Published Jun 9, 2023

Updated

It was discovered that jupyter-core, the core common functionality for Jupyter projects, could execute arbitrary code in the current working directory while loading configuration files.

Affected Software

2 affected components

debian/jupyter-core

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade jupyter-core to a version that resolves this vulnerability.
Patch DSA-5422-1

Event History

Jun 9, 2023

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-39286

Frequently Asked Questions

Under what condition can arbitrary code be executed?

The issue occurs when jupyter-core loads configuration files and code is present in the current working directory.

What component should be prioritized for remediation?

Systems using Debian's jupyter-core package should apply the Debian security update referenced by DSA-5422.