CVE-2014-3429

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-08-07 · updated 2026-06-17
Weakness: CWE-94

Description

IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.

Affected products

Ipython Notebook: 0.12, 0.12.1, 0.13, 0.13.1, 0.13.2, 1.0.0 (+1)
Mageia: 3.0, 4.0
Opensuse: 13.1, 13.2

References

http://advisories.mageia.org/MGASA-2014-0320.html
http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython
http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html
http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198
http://seclists.org/oss-sec/2014/q3/152
http://www.mandriva.com/security/advisories?name=MDVSA-2015:160
https://bugzilla.redhat.com/show_bug.cgi?id=1119890
https://exchange.xforce.ibmcloud.com/vulnerabilities/94497
https://github.com/ipython/ipython/pull/4845
http://advisories.mageia.org/MGASA-2014-0320.html
http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython
http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html

Get alerted when CVE-2014-3429 or the next vulnerability affects your stack