-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| jupyter-remote-desktop-proxy | pip | = 3.0.0 | 3.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in how jupyter-remote-desktop-proxy configured TigerVNC. The provided commit 7dd54c25a4253badd8ea68895437e5a66a59090d directly addresses this by modifying the setup_websockify function in jupyter_remote_desktop_proxy/setup_websockify.py. This function prepares the arguments for launching the VNC server. The patch introduces a check to identify if the VNC server is TigerVNC (by checking for the absence of 'turbovnc' in its script content) and adds the -rfbport -1 argument. This argument explicitly tells TigerVNC not to open a TCP port. The absence of this argument in the vulnerable version (3.0.0) for TigerVNC is the root cause of the vulnerability, making the setup_websockify function the direct location where the vulnerable configuration was applied.
PythonPythonOngoing coverage of React2Shell