Fedora alert FEDORA-2026-dd1d19e58b (python-jupyter-server)

From:
             
 
updates--- via package-announce <package-announce@lists.fedoraproject.org>
To:
             
 
package-announce@lists.fedoraproject.org
Subject:
             
 
[SECURITY] Fedora 44 Update: python-jupyter-server-2.20.0-1.fc44
Date:
             
 
Sun, 05 Jul 2026 01:10:25 +0000
Message-ID:
             
 
<20260705011025.43E4F8AF7C@bastion01.rdu3.fedoraproject.org>
Archive-link:
             
 
Article
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-dd1d19e58b
2026-07-05 01:07:02.694197+00:00
--------------------------------------------------------------------------------

Name        : python-jupyter-server
Product     : Fedora 44
Version     : 2.20.0
Release     : 1.fc44
URL         : https://jupyter-server.readthedocs.io
Summary     : The backend for Jupyter web applications
Description :
The Jupyter Server provides the backend (i.e. the core services,
APIs, and REST endpoints) for Jupyter web applications like
Jupyter notebook, JupyterLab, and Voila.

--------------------------------------------------------------------------------
Update Information:

New version fixing high-severity CVE.
New version of jupyter-server fixing various security vulnerabilities.
--------------------------------------------------------------------------------
ChangeLog:

* Fri Jun 19 2026 Lumir Balhar <lbalhar@redhat.com> - 2.20.0-1
- Update to 2.20.0 (rhbz#2489836)
* Thu Jun  4 2026 Python Maint <python-maint@redhat.com> - 2.19.0-2
- Rebuilt for Python 3.15
* Mon Jun  1 2026 Lumir Balhar <lbalhar@redhat.com> - 2.19.0-1
- Update to 2.19.0 (rhbz#2483209)
* Mon May 11 2026 Lumir Balhar <lbalhar@redhat.com> - 2.18.2-1
- Update to 2.18.2 (rhbz#2466683)
* Tue May  5 2026 Lumir Balhar <lbalhar@redhat.com> - 2.18.0-1
- Update to 2.18.0 (rhbz#2465646)
* Tue Apr 14 2026 Tomáš Hrnčiar <thrnciar@redhat.com> - 2.17.0-5
- Raise pytest upper bound to allow pytest 9
* Fri Mar 20 2026 Lumir Balhar <lbalhar@redhat.com> - 2.17.0-4
- Ignore deprecation warnings from ptyprocess:pty to fix build with Python
  3.15 alpha 7
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2484708 - CVE-2026-35397 python-jupyter-server: Jupyter Server: Unauthorized File
Access via Path Traversal Vulnerability [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2484708
  [ 2 ] Bug #2484713 - CVE-2026-40934 python-jupyter-server: Jupyter Server: Authentication bypass
due to unrotated cookie secret [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2484713
  [ 3 ] Bug #2485374 - CVE-2026-6657 python-jupyter-server: jupyter-server: Arbitrary code
execution due to CORS origin validation bypass [fedora-all]
        https://bugzilla.redhat.com/show_bug.cgi?id=2485374
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-dd1d19e58b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgr...

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------



Attachment: None (type=text/plain)
-- 
_______________________________________________
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond...
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/package-ann...
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new