Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/19756?format=api",
    "purl": "pkg:pypi/jupyterhub@0.8.0b5",
    "type": "pypi",
    "namespace": "",
    "name": "jupyterhub",
    "version": "0.8.0b5",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": true,
    "next_non_vulnerable_version": "4.1.6",
    "latest_non_vulnerable_version": "4.1.6",
    "affected_by_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36851?format=api",
            "vulnerability_id": "VCID-jruk-8qvr-d3hh",
            "summary": "JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users.\nIn effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.",
            "references": [
                {
                    "reference_url": "https://github.com/jupyterhub/jupyterhub/commit/99e2720b0fc626cbeeca3c6337f917fdacfaa428",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.2",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
                        }
                    ],
                    "url": "https://github.com/jupyterhub/jupyterhub/commit/99e2720b0fc626cbeeca3c6337f917fdacfaa428"
                },
                {
                    "reference_url": "https://github.com/jupyterhub/jupyterhub/commit/ff2db557a85b6980f90c3158634bf924063ab8ba",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.2",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
                        }
                    ],
                    "url": "https://github.com/jupyterhub/jupyterhub/commit/ff2db557a85b6980f90c3158634bf924063ab8ba"
                },
                {
                    "reference_url": "https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-9x4q-3gxw-849f",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "7.2",
                            "scoring_system": "cvssv3.1",
                            "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
                        }
                    ],
                    "url": "https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-9x4q-3gxw-849f"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/42162?format=api",
                    "purl": "pkg:pypi/jupyterhub@4.1.6",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/jupyterhub@4.1.6"
                }
            ],
            "aliases": [
                "CVE-2024-41942",
                "GHSA-9x4q-3gxw-849f",
                "PYSEC-2024-200"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jruk-8qvr-d3hh"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/35712?format=api",
            "vulnerability_id": "VCID-n2n2-cfn6-fyau",
            "summary": "JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).",
            "references": [
                {
                    "reference_url": "https://github.com/advisories/GHSA-7xx3-qp5w-fw96",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-7xx3-qp5w-fw96"
                },
                {
                    "reference_url": "https://github.com/jupyterhub/jupyterhub/issues/3304",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/jupyterhub/jupyterhub/issues/3304"
                },
                {
                    "reference_url": "https://github.com/jupyterhub/jupyterhub/releases",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/jupyterhub/jupyterhub/releases"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/19777?format=api",
                    "purl": "pkg:pypi/jupyterhub@1.2.0b1",
                    "is_vulnerable": true,
                    "affected_by_vulnerabilities": [
                        {
                            "vulnerability": "VCID-jruk-8qvr-d3hh"
                        },
                        {
                            "vulnerability": "VCID-v61t-4jv9-j3bv"
                        }
                    ],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/jupyterhub@1.2.0b1"
                }
            ],
            "aliases": [
                "CVE-2020-36191",
                "GHSA-7xx3-qp5w-fw96",
                "PYSEC-2021-67"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-n2n2-cfn6-fyau"
        }
    ],
    "fixing_vulnerabilities": [],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/jupyterhub@0.8.0b5"
}