GHSA-cw7p-q79f-m2v7
incomplete JupyterHub logout with simultaneous JupyterLab sessions
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | jupyterhub | >= 1.0.0, < 1.5.0 | 1.5.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Users of JupyterLab with JupyterHub who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place.
### Patches
Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment.
### Workarounds
The only workaround is to make sure that only one JupyterLab tab is open when you log out.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-cw7p-q79f-m2v7
- https://nvd.nist.gov/vuln/detail/CVE-2021-41247
- https://github.com/jupyterhub/jupyterhub/commit/5ac9e7f73a6e1020ffddc40321fc53336829fe27
- https://github.com/jupyterhub/jupyterhub
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2021-386.yaml