CVE-2024-28188

Name of the Vulnerable Software and Affected Versions Jupyter Scheduler versions 1.0.0 through 1.1.5 Jupyter Scheduler version 1.2.0 Jupyter Scheduler versions 1.3.0 through 1.8.1 Jupyter Scheduler versions 2.0.0 through 2.5.1

Description Jupyter Scheduler is a collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of jupyter-scheduler users may be exposed, potentially revealing information about projects that a specific user may be working on. This issue is caused by a missing authentication check in Jupyter Server on the API endpoint GET /scheduler/runtime environments, which lists the names of the Conda environments on the server. An unauthenticated user can obtain the list of Conda environment names on the server, revealing any information that may be present in a Conda environment name.

Recommendations For Jupyter Scheduler versions 1.0.0 through 1.1.5, update to version 1.1.6. For Jupyter Scheduler version 1.2.0, update to version 1.2.1. For Jupyter Scheduler versions 1.3.0 through 1.8.1, update to version 1.8.2. For Jupyter Scheduler versions 2.0.0 through 2.5.1, update to version 2.5.2. As a temporary workaround, server operators who are unable to upgrade can disable the jupyter-scheduler extension with the command jupyter server extension disable jupyter-scheduler.