Inclusion of Sensitive Information in Log Files in Jupyter Notebook - CVE-2022-24758

Vulnerability identifier: #VU66865

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-24758

CWE-ID: CWE-532

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files, such as authentication cookies and header values when a 5xx error is triggered. A local user can read the log files and gain access to sensitive data.

Jupyter Notebook
IBM Cognos Analytics
Ubuntu
python3-notebook (Ubuntu package)
jupyter-notebook (Ubuntu package)
python-notebook (Ubuntu package)

Install updates from vendor's website.

Jupyter Notebook - update to 6.4.10
python3-notebook (Ubuntu package) - addressed in versions 5.2.2-1ubuntu0.1, 6.0.3-2ubuntu0.1, 6.4.8-1ubuntu0.1
jupyter-notebook (Ubuntu package) - addressed in versions 5.2.2-1ubuntu0.1, 6.0.3-2ubuntu0.1, 6.4.8-1ubuntu0.1
python-notebook (Ubuntu package) - update to 5.2.2-1ubuntu0.1
IBM Cognos Analytics - addressed in versions 11.1.7.6, 11.2.3

• https://github.com/jupyter/notebook/security/advisories/GHSA-m87f-39q9-6f55

• Information disclosure in Jupyter notebook
• Ubuntu update for jupyter-notebook
• Multiple vulnerabilities in IBM Cognos Analytics