CVE-2022-21697

Advisory

Jupyter-server-proxy 3.2.1 includes a fix for CVE-2022-21697: Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the 'allowed_hosts' check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity.
https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-gcv9-6737-pjqw

Affected package

Affected versions

Fixed versions

Vulnerability changelog

3.2.1 is a security release, fixing a vulnerability [GHSA-gcv9-6737-pjqw](https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-gcv9-6737-pjqw) where `allowed_hosts` were not validated correctly.

Maintenance and upkeep improvements

- Modernize docs without making changes to its content [313](https://github.com/jupyterhub/jupyter-server-proxy/pull/313) ([consideRatio](https://github.com/consideRatio))
- Remove no longer needed logic involving six [312](https://github.com/jupyterhub/jupyter-server-proxy/pull/312) ([consideRatio](https://github.com/consideRatio))
- Update language, from master to main [311](https://github.com/jupyterhub/jupyter-server-proxy/pull/311) ([consideRatio](https://github.com/consideRatio))

Other merged PRs

- Remove empty JupyterLab style [314](https://github.com/jupyterhub/jupyter-server-proxy/pull/314) ([bollwyvl](https://github.com/bollwyvl))
- ci: avoid triggering ci twice on pre-commit.ci/dependabot prs [310](https://github.com/jupyterhub/jupyter-server-proxy/pull/310) ([consideRatio](https://github.com/consideRatio))

Contributors to this release

([GitHub contributors page for this release](https://github.com/jupyterhub/jupyter-server-proxy/graphs/contributors?from=2021-11-29&to=2022-01-19&type=c))

[bollwyvl](https://github.com/search?q=repo%3Ajupyterhub%2Fjupyter-server-proxy+involves%3Abollwyvl+updated%3A2021-11-29..2022-01-19&type=Issues) | [consideRatio](https://github.com/search?q=repo%3Ajupyterhub%2Fjupyter-server-proxy+involves%3AconsideRatio+updated%3A2021-11-29..2022-01-19&type=Issues) | [welcome](https://github.com/search?q=repo%3Ajupyterhub%2Fjupyter-server-proxy+involves%3Awelcome+updated%3A2021-11-29..2022-01-19&type=Issues) | [yuvipanda](https://github.com/search?q=repo%3Ajupyterhub%2Fjupyter-server-proxy+involves%3Ayuvipanda+updated%3A2021-11-29..2022-01-19&type=Issues)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21697
• https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch
• https://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-gcv9-6737-pjqw
• https://github.com/jupyterhub/jupyter-server-proxy/commit/fd31930bacd12188c448c886e0783529436b99eb