GHSA-3vff-hjqv-m7h8
JupyterHub has an Open Redirect Vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | jupyterhub | < 5.4.4 | 5.4.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
## Affected Version
JupyterHub <= 5.4.3
## Impact
An open redirect vulnerability in JupyterHub <=5.4.3 allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this.
## Patches
Upgrade to JupyterHub 5.4.4
## Workarounds
A deployment can apply filters on the Location header in a reverse proxy such as nginx/apache/traefik.
References
External links from the advisory. They lead to third-party sites.