USN-7464-1 — jupyter-notebook vulnerability

Summary

It was discovered that Jupyter Notebook did not properly parse HTML
comments under certain circumstances. An attacker could possibly use this
issue to cause a regular expression denial of service (ReDoS).

Fixed packages 2

Release	Package	Fixed in
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS	jupyter-notebook	6.4.8-1ubuntu0.1+esm1
Ubuntu · Pro 24.04 LTS Pro:24.04:LTS	jupyter-notebook	6.4.12-2.2ubuntu1+esm1

Vulnerabilities 1

Medium 5.3

CVE-2022-25887

Regular Expression Denial of Service (ReDoS)

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.

sanitize-html jupyter-notebook node-sanitize-html node-sanitize-html Debian Ubuntu npm

Aug 30, 2022

References

report
https://ubuntu.com/security/CVE-2022-25887

jupyter-notebook vulnerability

Summary

Fixed packages 2

Vulnerabilities 1

Regular Expression Denial of Service (ReDoS)

References