CVE-2016-6524

Advisory

[This advisory has been limited. Please create a free account to view the full advisory.]

Affected package

Affected versions

[This affected versions has been limited. Please create a free account to view the full affected versions.]

Fixed versions

[This fixed versions has been limited. Please create a free account to view the full fixed versions.]

Vulnerability changelog

4.2.2 is a small bugfix release on 4.2, with an important security fix.
All users are strongly encouraged to upgrade to 4.2.2.

> Highlights:

- **Security fix**: CVE-2016-6524, where untrusted latex output could
be added to the page in a way that could execute javascript.
- Fix missing POST in OPTIONS responses.
- Fix for downloading non-ascii filenames.
- Avoid clobbering ssl_options, so that users can specify more
detailed SSL configuration.
- Fix inverted load order in nbconfig, so user config has highest
priority.
- Improved error messages here and there.

Resources

• https://pypi.org/project/notebook
• https://pyup.io/changelogs/notebook/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6524