CVE-2015-4706: XSS
Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.
Other sources
From http://ipython.org/ipython-doc/3/whatsnew/version3.html :
IPython 3.2 contains important security fixes. Users are strongly encouraged to upgrade immediately.
Highlights:
A security improvement that set the secure attribute to login cookie to prevent them to be sent over http Revert the face color of matplotlib axes in the inline backend to not be transparent. Enable mathjax safe mode by default Fix XSS vulnerability in JSON error messages Various widget-related fixes
See Issues closed in the 3.x development cycle for details: https://github.com/ipython/ipython/issues?utf8=%E2%9C%93&q=milestone%3A3.2+is%3Aclosed+
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4706?
CVE-2015-4706 has been classified as a moderate severity cross-site scripting (XSS) vulnerability.
What software versions are affected by CVE-2015-4706?
CVE-2015-4706 affects IPython versions 3.0.0 and 3.1.0.
How do I fix CVE-2015-4706?
To fix CVE-2015-4706, upgrade to IPython version 3.2.0 or higher.
Can CVE-2015-4706 be exploited remotely?
Yes, CVE-2015-4706 can be exploited by remote attackers through the injection of malicious web scripts.
What actions can be taken to mitigate CVE-2015-4706?
Mitigation of CVE-2015-4706 involves applying the appropriate software update to remove the vulnerability.