CVE-2025-32428

Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network. This vulnerability does not affect users having TurboVNC as the vncserver executable. This issue is fixed in 3.0.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/jupyterhub/jupyter-remote-desktop-proxy/commit/7dd54c25a4253badd8ea68895437e5a66a59090d
https://github.com/jupyterhub/jupyter-remote-desktop-proxy/security/advisories/GHSA-vrq4-9hc3-cgp7

Configurations

No configuration.

History

15 Apr 2025, 18:39

Type	Values Removed	Values Added
Summary		(es) Jupyter Remote Desktop Proxy permite ejecutar un escritorio Linux en un JupyterHub. Desde la versión 3.0.0, jupyter-remote-desktop-proxy estaba diseñado para depender de sockets UNIX legibles únicamente por el usuario actual, pero al usarlo con TigerVNC, el servidor VNC iniciado por jupyter-remote-desktop-proxy seguía siendo accesible a través de la red. Esta vulnerabilidad no afecta a los usuarios que tienen TurboVNC como ejecutable de vncserver. Este problema se solucionó en la versión 3.0.1.

15 Apr 2025, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-15 00:15

Updated : 2025-04-15 18:39

NVD link : CVE-2025-32428

Mitre link : CVE-2025-32428

CVE.ORG link : CVE-2025-32428

JSON object : View

Products Affected

No product.

CWE

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2025-32428", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.0, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-04-15T00:15:14.880", "references": [{"url": "https://github.com/jupyterhub/jupyter-remote-desktop-proxy/commit/7dd54c25a4253badd8ea68895437e5a66a59090d", "source": "security-advisories@github.com"}, {"url": "https://github.com/jupyterhub/jupyter-remote-desktop-proxy/security/advisories/GHSA-vrq4-9hc3-cgp7", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "Jupyter Remote Desktop Proxy allows you to run a Linux Desktop on a JupyterHub. jupyter-remote-desktop-proxy was meant to rely on UNIX sockets readable only by the current user since version 3.0.0, but when used with TigerVNC, the VNC server started by jupyter-remote-desktop-proxy were still accessible via the network. This vulnerability does not affect users having TurboVNC as the vncserver executable. This issue is fixed in 3.0.1."}, {"lang": "es", "value": "Jupyter Remote Desktop Proxy permite ejecutar un escritorio Linux en un JupyterHub. Desde la versi\u00f3n 3.0.0, jupyter-remote-desktop-proxy estaba dise\u00f1ado para depender de sockets UNIX legibles \u00fanicamente por el usuario actual, pero al usarlo con TigerVNC, el servidor VNC iniciado por jupyter-remote-desktop-proxy segu\u00eda siendo accesible a trav\u00e9s de la red. Esta vulnerabilidad no afecta a los usuarios que tienen TurboVNC como ejecutable de vncserver. Este problema se solucion\u00f3 en la versi\u00f3n 3.0.1."}], "lastModified": "2025-04-15T18:39:27.967", "sourceIdentifier": "security-advisories@github.com"}