7.5

CVE-2021-41247: jupyter jupyterhub Insufficient Session Expiration

CVSS: 7.5v3.1HighModified
AliasesGHSA-cw7p-q79f-m2v7BIT-jupyterhub-2021-41247PYSEC-2021-386
Published 04-11-2021Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2021-41247 is a high (CVSS 7.5) Insufficient Session Expiration vulnerability in jupyter jupyterhub. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
0.80%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 04-11-2021
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials (for the single-user server only, not the Hub) reinstated after logout, if another active JupyterLab session is open while the logout takes place. Upgrade to JupyterHub 1.5. For distributed deployments, it is jupyterhub in the _user_ environment that needs patching. There are no patches necessary in the Hub environment. The only workaround is to make sure that only one JupyterLab tab is open when you log out.

CVSS metrics

6 scores · 4 sources · 3 versions

EPSS trend

Probability

0.80%

Chance of exploitation in the next 30 days

Percentile

56%

Versus all other CVEs

30-day change

0.00 pp

From 0.80% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.80%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • jupyterhub< 2.0.0+ds1-1
Jupyter1 product
Jupyterhub1 product
  • jupyterhub≥ 1.0.0, < 1.5.0 - jupyterhub (pip) (No fix recorded) | < 1.2.0 - jupyterhub (helm)
PyPI1 product
  • jupyterhub< 5ac9e7f73a6e1020ffddc40321fc53336829fe27 | ≥ 1.0.0, < 1.5.0

4 vendors · 4 products

References

6 links