Vulnerability-Lookup

ubuntu-cve-2022-39286

Vulnerability from osv_ubuntu

Published

2022-10-26 20:15

Modified

2025-10-24 04:53

Summary

Details

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in jupyter_core that stems from jupyter_core executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-39286	REPORT
	https://github.com/jupyter/jupyter_core/commit/11…	REPORT
	https://github.com/jupyter/jupyter_core/security/…	REPORT
	https://ubuntu.com/security/notices/USN-6153-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2022-39286	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "jupyter",
            "binary_version": "4.4.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "jupyter-core",
            "binary_version": "4.4.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "python-jupyter-core",
            "binary_version": "4.4.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "python3-jupyter-core",
            "binary_version": "4.4.0-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "jupyter-core",
        "purl": "pkg:deb/ubuntu/jupyter-core@4.4.0-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.0-2ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.3.0-1",
        "4.4.0-1",
        "4.4.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "jupyter",
            "binary_version": "4.6.3-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "jupyter-core",
            "binary_version": "4.6.3-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "python3-jupyter-core",
            "binary_version": "4.6.3-3ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "jupyter-core",
        "purl": "pkg:deb/ubuntu/jupyter-core@4.6.3-3ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.3-3ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.5.0-2",
        "4.6.0-1",
        "4.6.1-1",
        "4.6.2-1ubuntu1",
        "4.6.3-3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "jupyter",
            "binary_version": "4.9.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "jupyter-core",
            "binary_version": "4.9.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "python3-jupyter-core",
            "binary_version": "4.9.1-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "jupyter-core",
        "purl": "pkg:deb/ubuntu/jupyter-core@4.9.1-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.9.1-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.7.1-1",
        "4.9.1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.",
  "id": "UBUNTU-CVE-2022-39286",
  "modified": "2025-10-24T04:53:50Z",
  "published": "2022-10-26T20:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-39286"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrp"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6153-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-39286"
    }
  ],
  "related": [
    "USN-6153-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-39286"
  ]
}

CVE-2022-39286 (GCVE-0-2022-39286)

Vulnerability from cvelistv5 – Published: 2022-10-26 00:00 – Updated: 2025-04-23 16:43

Title

Execution with Unnecessary Privileges in JupyterApp

Summary

Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-269 - Improper Privilege Management
CWE-250 - Execution with Unnecessary Privileges

Assigner

GitHub_M

References

7 references

URL	Tags
https://github.com/jupyter/jupyter_core/security/…
https://github.com/jupyter/jupyter_core/commit/11…
https://lists.debian.org/debian-lts-announce/2022…	mailing-list
https://security.gentoo.org/glsa/202301-04	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://www.debian.org/security/2023/dsa-5422	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
jupyter	jupyter_core	Affected: < 4.11.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:00:43.783Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrp"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283"
          },
          {
            "name": "[debian-lts-announce] 20221117 [SECURITY] [DLA 3195-1] jupyter-core security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00022.html"
          },
          {
            "name": "GLSA-202301-04",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202301-04"
          },
          {
            "name": "FEDORA-2023-de87bd076b",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDN7JMLK6AOMBQI4QPSW4MBQGWQ5NIN/"
          },
          {
            "name": "FEDORA-2023-d966145959",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KKMP5OXXIX2QAUNVNJZ5UEQFKDYYJVBA/"
          },
          {
            "name": "DSA-5422",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5422"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-39286",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:47:29.874045Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:43:15.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyter_core",
          "vendor": "jupyter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.11.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vulnerability in `jupyter_core` that stems from `jupyter_core` executing untrusted files in CWD. This vulnerability allows one user to run code as another. Version 4.11.2 contains a patch for this issue. There are no known workarounds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250: Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-09T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/jupyter/jupyter_core/security/advisories/GHSA-m678-f26j-3hrp"
        },
        {
          "url": "https://github.com/jupyter/jupyter_core/commit/1118c8ce01800cb689d51f655f5ccef19516e283"
        },
        {
          "name": "[debian-lts-announce] 20221117 [SECURITY] [DLA 3195-1] jupyter-core security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00022.html"
        },
        {
          "name": "GLSA-202301-04",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202301-04"
        },
        {
          "name": "FEDORA-2023-de87bd076b",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YIDN7JMLK6AOMBQI4QPSW4MBQGWQ5NIN/"
        },
        {
          "name": "FEDORA-2023-d966145959",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KKMP5OXXIX2QAUNVNJZ5UEQFKDYYJVBA/"
        },
        {
          "name": "DSA-5422",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5422"
        }
      ],
      "source": {
        "advisory": "GHSA-m678-f26j-3hrp",
        "discovery": "UNKNOWN"
      },
      "title": "Execution with Unnecessary Privileges in JupyterApp"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39286",
    "datePublished": "2022-10-26T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-04-23T16:43:15.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-6153-1

Vulnerability from osv_ubuntu

Published

2023-06-12 00:23

Modified

2026-04-27 14:11

Summary

jupyter-core vulnerability

Details

It was discovered that Jupyter Core executed untrusted files in the current working directory. An attacker could possibly use this issue to execute arbitrary code.

References

URL

Type

	https://ubuntu.com/security/notices/USN-6153-1	ADVISORY
	https://ubuntu.com/security/CVE-2022-39286	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-39286",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "jupyter",
            "binary_version": "4.4.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "jupyter-core",
            "binary_version": "4.4.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "python-jupyter-core",
            "binary_version": "4.4.0-2ubuntu0.1~esm1"
          },
          {
            "binary_name": "python3-jupyter-core",
            "binary_version": "4.4.0-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "jupyter-core",
        "purl": "pkg:deb/ubuntu/jupyter-core@4.4.0-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.0-2ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.3.0-1",
        "4.4.0-1",
        "4.4.0-2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-39286",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "jupyter",
            "binary_version": "4.6.3-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "jupyter-core",
            "binary_version": "4.6.3-3ubuntu0.1~esm1"
          },
          {
            "binary_name": "python3-jupyter-core",
            "binary_version": "4.6.3-3ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "jupyter-core",
        "purl": "pkg:deb/ubuntu/jupyter-core@4.6.3-3ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.3-3ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.5.0-2",
        "4.6.0-1",
        "4.6.1-1",
        "4.6.2-1ubuntu1",
        "4.6.3-3"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-39286",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "jupyter",
            "binary_version": "4.9.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "jupyter-core",
            "binary_version": "4.9.1-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "python3-jupyter-core",
            "binary_version": "4.9.1-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "jupyter-core",
        "purl": "pkg:deb/ubuntu/jupyter-core@4.9.1-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.9.1-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.7.1-1",
        "4.9.1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Jupyter Core executed untrusted files in the current\nworking directory. An attacker could possibly use this issue to execute\narbitrary code.\n",
  "id": "USN-6153-1",
  "modified": "2026-04-27T14:11:30Z",
  "published": "2023-06-12T00:23:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6153-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-39286"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "jupyter-core vulnerability",
  "upstream": [
    "UBUNTU-CVE-2022-39286"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2022-39286

Vulnerability from osv_ubuntu

CVE-2022-39286 (GCVE-0-2022-39286)

usn-6153-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature