CVE-2024-28188

Advisory

jupyter_scheduler has a missing authentication check in Jupyter Server on an API endpoint (GET /scheduler/runtime_environments) which lists the names of the Conda environments on the server. In affected versions, this allows an unauthenticated user to obtain the list of Conda environment names on the server, potentially revealing sensitive information embedded in those names.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/jupyter-server/jupyter_server/pull/1392
• https://github.com/advisories/GHSA-v9g2-g7j4-4jxc
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28188