Ubuntu
ipython package

CVE-2014-3429: remote execution via cross origin websocket

Bug #1344854 reported by Julian Taylor
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ipython (Ubuntu)
Fix Released
Undecided
Unassigned
Precise
Fix Released
Undecided
Unassigned

Bug Description

ipython 0.12 in precise is affected by CVE-2014-3429 which allows remote execution of code if one has knowledge of the kernel id (uuid)

the version in lucid and trusty are not affected

See this page for details of the issue:
http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython

See original description
Revision history for this message
Julian Taylor (jtaylor) wrote :
Changed in ipython (Ubuntu):
status: New → Fix Released
description: updated
Revision history for this message
Dimitri John Ledkov (xnox) wrote :

Looks good to me. Leaving for security team to handle sponsorship, as I don't know the proper procedure for uploading these.

Changed in ipython (Ubuntu Precise):
status: New → Confirmed
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Everything looks great. Thanks! I'm uploading this to the security ppa now and will push it out after it builds.

Changed in ipython (Ubuntu Precise):
status: Confirmed → In Progress
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ipython - 0.12.1+dfsg-0ubuntu1.1

---------------
ipython (0.12.1+dfsg-0ubuntu1.1) precise-security; urgency=medium

  * SECURITY UPDATE: remote execution via cross origin websocket if one has
    knowledge of the kernel id (LP: #1344854)
    - debian/patches/CVE-2014-3429.patch: check origin of connections
    - CVE-2014-3429
 -- Julian Taylor <email address hidden> Sat, 19 Jul 2014 14:05:50 +0200

Changed in ipython (Ubuntu Precise):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.