Cross-site request forgery in ipython and Fedora - CVE-2015-5607

Vulnerability identifier: #VU38231

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-5607

CWE-ID: CWE-352

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Cross-site request forgery in the REST API in IPython 2 and 3.

ipython
Fedora
Ubuntu
python3-ipython (Ubuntu package)
ipython3 (Ubuntu package)
ipython (Ubuntu package)
python-ipython (Ubuntu package)
ipython3-notebook (Ubuntu package)
ipython-notebook-common (Ubuntu package)
ipython-notebook (Ubuntu package)
ipython

Install update from vendor's website.

python3-ipython (Ubuntu package) - update to Ubuntu Pro
ipython3 (Ubuntu package) - update to Ubuntu Pro
ipython (Ubuntu package) - update to Ubuntu Pro
python-ipython (Ubuntu package) - update to Ubuntu Pro
ipython3-notebook (Ubuntu package) - update to Ubuntu Pro
ipython-notebook-common (Ubuntu package) - update to Ubuntu Pro
ipython-notebook (Ubuntu package) - update to Ubuntu Pro
ipython - addressed in versions 2.4.1-7.fc21, 2.4.1-7.fc22

• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162671.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162936.html
• http://www.openwall.com/lists/oss-security/2015/07/21/3
• https://bugzilla.redhat.com/show_bug.cgi?id=1243842
• https://github.com/ipython/ipython/commit/1415a9710407e7c14900531813c15ba6165f0816
• https://github.com/ipython/ipython/commit/a05fe052a18810e92d9be8c1185952c13fe4e5b0

• Cross-site request forgery in ipython
• Ubuntu update for ipython
• Fedora 21 update for ipython
• Fedora 22 update for ipython