CVE-2021-41247: incomplete JupyterHub logout with simultaneous JupyterLab sessions

CVE-2021-41247 · Severity: low · CVSS 3.1 · Published 2021-11-04

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.

Technologies: jupyterhub (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-41247 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-41247 being exploited in the wild.
How severe is CVE-2021-41247?
Low severity, with a CVSS score of 3.1, published 4 November 2021.
Which products and versions are affected?
jupyterhub (PyPI) ECOSYSTEM:introduced=1.0.0,fixed=1.5.0, GIT:introduced=0,fixed=5ac9e7f73a6e1020ffddc40321fc53336829fe27|ECOSYSTEM:introduced=1.0.0,fixed=1.5.0.
Is there a fix for CVE-2021-41247?
Yes. jupyterhub (PyPI): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2021-41247?
Check whether you run jupyterhub (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • jupyterhub (PyPI): upgrade to 1.5.0 or later
    pip install "jupyterhub>=1.5.0"

Affected products

  • jupyterhub (PyPI) ECOSYSTEM:introduced=1.0.0,fixed=1.5.0, GIT:introduced=0,fixed=5ac9e7f73a6e1020ffddc40321fc53336829fe27|ECOSYSTEM:introduced=1.0.0,fixed=1.5.0

Identifiers

  • CVE-2021-41247
  • GHSA-cw7p-q79f-m2v7
  • PYSEC-2021-386

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.