CVE:CVE-2015-6938
CNNVD:CNNVD-201509-396
IPython是IPython团队开发的一个Python的原生交互式shell的增强版。Notebook是其中的一个开发环境。Jupyter Notebook是其中的一套用于创建、共享代码和说明性文本文档的Web应用程序。
IPython Notebook 3.2.2之前版本和Jupyter Notebook 4.0.5之前4.0.x版本的notebook/notebookapp.py文件中的文件浏览器中存在跨站脚本漏洞。远程攻击者可借助文件夹名称利用该漏洞注入任意Web脚本或HTML。
solution:Upgrade jupyter notebook to a higher version than 4.0.0,4.0.1,4.0.2,4.0.3,4.0.4,and avoid the version 4.0.0,4.0.1,4.0.2,4.0.3,4.0.4; Upgrade fedoraproject fedora to a higher version than 21,22,23,and avoid the version 21,22,23; Upgrade opensuse opensuse to a higher version than 13.1,13.2,and avoid the version 13.1,13.2; Upgrade ipython notebook to a higher version than 3.2.1,and avoid the version (,3.2.1]