{"id":"CVE-2014-3429","aliases":["DEBIAN-CVE-2014-3429","EUVD-2014-0022","GHSA-75cw-5cgv-g853","MGASA-2014-0320","PYSEC-2014-21","UBUNTU-CVE-2014-3429"],"status":"published","title":"IPython Notebook vulnerable to improper validation of the origin of websocket requests","description":"IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04686,"percentile":0.91844,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2014-08-06T10:31:11Z","modified":"2026-10-23T15:47:37Z","fixes":[{"ecosystem":"PyPI","package":"ipython","fixed_in":["1.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ipython","fixed_in":["1.2.0~rc1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ipython","fixed_in":["1.2.0~rc1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ipython","fixed_in":["1.2.0~rc1-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"ipython","fixed_in":["0.13.2-1.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"ipython","fixed_in":["1.1.0-3.1.mga4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12"},{"fixed":"1.2.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0~rc1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0~rc1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0~rc1-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12"},{"fixed":"1.2.0"}]}],"versions":["0.12","0.12.1","0.13","0.13.1","0.13.2","1.0.0","1.1.0"]},{"source":"osv","ecosystem":"Mageia:3","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.2-1.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-3.1.mga4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"ipython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12"},{"fixed":"1.2.0"}]}],"versions":["0.12","0.12.1","0.13","0.13.1","0.13.2","1.0.0","1.1.0"]}],"products":[{"vendor":"ipython","product":"ipython_notebook"},{"vendor":"mageia","product":"mageia"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2014-08/msg00039.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/94497","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://github.com/ipython/ipython/pull/4845","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1119890","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report","web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0320.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lambdaops.com/cross-origin-websocket-hijacking-of-ipython","tags":["x_refsource_CONFIRM","x_transferred","Press/Media Coverage","Technical Description","article","web"]},{"url":"http://seclists.org/oss-sec/2014/q3/152","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://permalink.gmane.org/gmane.comp.python.ipython.devel/13198","tags":["mailing-list","x_refsource_MLIST","x_transferred","Broken Link","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:160","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Broken Link","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3429","tags":["advisory"]},{"url":"https://github.com/ipython/ipython/commit/e5b669ce4750d628dba383fd637dbde918ea15f5","tags":["web"]},{"url":"https://github.com/mattvonrocketstein/ipython/commit/dd4135db9f42d196a46553310a8e63ff5658671d","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/ipython/PYSEC-2014-21.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-75cw-5cgv-g853","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3429","tags":["advisory"]},{"url":"https://github.com/ipython/ipython","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0320.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13744","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2014/07/15/2","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135763.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-3429","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3429","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-3429","description":"IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.","status":"published","published":"2014-08-07T10:00:00Z","modified":"2024-08-06T10:43:05.847Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-0022","description":"IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.","status":"published","published":"2014-08-07T10:00:00Z","modified":"2024-08-06T10:43:05Z","updated_at":"2026-11-03T01:57:11.29077Z"}],"ghsa":[{"id":"GHSA-75cw-5cgv-g853","title":"IPython Notebook vulnerable to improper validation of the origin of websocket requests ","description":"IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.","status":"published","published":"2022-05-14T02:05:20Z","modified":"2024-09-23T16:59:57Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2014-3429","description":"IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.","status":"published","published":"2014-08-07T11:13:34.843Z","modified":"2026-06-17T00:08:10.127Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"GHSA-75cw-5cgv-g853","title":"IPython Notebook vulnerable to improper validation of the origin of websocket requests ","description":"IPython Notebook 0.12 through 1.x before 1.2.0 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.","status":"published","published":"2022-05-14T02:05:20Z","modified":"2024-09-23T17:08:29.475348Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"CVE-2014-3429","description":"IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.","status":"published","published":"2014-08-07T11:13:34Z","modified":"2026-04-16T06:22:35.5526279Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3429","description":"IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.","status":"published","published":"2014-08-07T11:13:34.843Z","modified":"2026-10-23T15:47:37.237381591Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0320","title":"Updated ipython package fixes security vulnerability","description":"In IPython before 1.2, the origin of websocket requests was not verified\nwithin the IPython notebook server. If an attacker has knowledge of an IPython\nkernel id they can run arbitrary code on a user's machine when the client\nvisits a crafted malicious page (CVE-2014-3429).\n","status":"published","published":"2014-08-06T10:31:11Z","modified":"2026-04-16T06:24:04.945536865Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"PYSEC-2014-21","description":"IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.","status":"published","published":"2014-08-07T11:13:00Z","modified":"2026-06-10T17:01:52.195498759Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"UBUNTU-CVE-2014-3429","description":"IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.","status":"withdrawn","published":"2014-08-07T11:13:00Z","modified":"2025-07-16T07:31:56.284932Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}