CVE-2014-3429
IPython Notebook vulnerable to improper validation of the origin of websocket requests
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
Exploit likelihood
What each source reports
NVD Score used
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
- Record
CVE-2014-3429- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
- Record
CVE-2014-3429- Updated
- 2026-11-02
EUVDEUVD-2014-0022 No score
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
- Record
EUVD-2014-0022- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-75cw-5cgv-g853
IPython Notebook vulnerable to improper validation of the origin of websocket requests
IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
- Record
GHSA-75cw-5cgv-g853- CVSS 4.0
- 8.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-75cw-5cgv-g853
IPython Notebook vulnerable to improper validation of the origin of websocket requests
IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
- Record
GHSA-75cw-5cgv-g853- CVSS 4.0
- 8.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
- Record
CVE-2014-3429- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2014-3429 No score
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
- Record
DEBIAN-CVE-2014-3429- Updated
- 2026-11-02
OSVMGASA-2014-0320 No score
Updated ipython package fixes security vulnerability
In IPython before 1.2, the origin of websocket requests was not verified within the IPython notebook server. If an attacker has knowledge of an IPython kernel id they can run arbitrary code on a user's machine when the client visits a crafted malicious page (CVE-2014-3429).
- Record
MGASA-2014-0320- Updated
- 2026-11-02
OSVPYSEC-2014-21 No score
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
- Record
PYSEC-2014-21- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3429 No score
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.
- Record
UBUNTU-CVE-2014-3429- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ipythonPyPI |
0.12 up to 1.2.0 | 1.2.0 |
ipythonDebian:12 |
before 1.2.0~rc1-1 | 1.2.0~rc1-1 |
ipythonDebian:13 |
before 1.2.0~rc1-1 | 1.2.0~rc1-1 |
ipythonDebian:14 |
before 1.2.0~rc1-1 | 1.2.0~rc1-1 |
ipythonPyPI |
0.12 up to 1.2.0, plus listed versions 0.12.10.130.13.10.13.21.0.01.1.0 |
1.2.0 |
ipythonMageia:3 |
before 0.13.2-1.1.mga3 | 0.13.2-1.1.mga3 |
ipythonMageia:4 |
before 1.1.0-3.1.mga4 | 1.1.0-3.1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3429 is a medium vulnerability (CVSS 6.8) in Ipython Notebook, published August 6, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.70%, the 91st percentile. Fixed in ipython 1.2.0.
References
lists.opensuse.org/opensuse-updates/2014-08/msg00039.html
exchange.xforce.ibmcloud.com/vulnerabilities/94497
github.com/ipython/ipython/pull/4845
bugzilla.redhat.com/show_bug.cgi?id=1119890
advisories.mageia.org/MGASA-2014-0320.html
lambdaops.com/cross-origin-websocket-hijacking-of-ipython
Show 15 moreShow less
seclists.org/oss-sec/2014/q3/152
permalink.gmane.org/gmane.comp.python.ipython.devel/13198
mandriva.com/security/advisories?name=MDVSA-2015:160
nvd.nist.gov/vuln/detail/CVE-2014-3429
security-tracker.debian.org/tracker/CVE-2014-3429
bugs.mageia.org/show_bug.cgi?id=13744
openwall.com/lists/oss-security/2014/07/15/2
lists.fedoraproject.org/pipermail/package-announce/2014-July/135763.html
ubuntu.com/security/CVE-2014-3429
cve.org/CVERecord?id=CVE-2014-3429