Bug 939064 (CVE-2015-5607) - VUL-0: CVE-2015-5607: iptyhon: cross-site request forgery in get_origin()
Summary: VUL-0: CVE-2015-5607: iptyhon: cross-site request forgery in get_origin()
Status: RESOLVED FIXED
Alias: CVE-2015-5607
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Jan Matejek
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/119157/
Whiteboard: CVSSv2:RedHat:CVE-2015-5607:4.3:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-07-22 09:49 UTC by Johannes Segitz
Modified: 2017-08-09 22:41 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2015-07-22 09:49:52 UTC 
From: Kyle Kelley 

Patches:
  2.x:
https://github.com/ipython/ipython/commit/a05fe052a18810e92d9be8c1185952c13fe4e5b0
  3.x:
https://github.com/ipython/ipython/commit/1415a9710407e7c14900531813c15ba6165f0816

Affected versions: 0.12 ≤ version ≤ 3.2.0

Summary: POST requests exposed via the IPython REST API are vulnerable to
cross-site request forgery (CSRF). Web pages on different domains can make
non-AJAX POST requests to known IPython URLs, and IPython will honor them.
The user's browser will automatically send IPython cookies along with the
requests. The response is blocked by the Same-Origin Policy, but the
request isn't.

API paths with issues:

* POST /api/contents/<path>/<file>
* POST /api/contents/<path>/<file>/checkpoints
* POST /api/contents/<path>/<file>/checkpoints/<checkpoint_id>
* POST /api/kernels
* POST /api/kernels/<kernel_id>/<action>
* POST /api/sessions
* POST /api/clusters/<cluster_id>/<action>


References:
https://bugzilla.redhat.com/show_bug.cgi?id=1243842
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5607
http://seclists.org/oss-sec/2015/q3/157
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5607
Comment 2 Swamp Workflow Management 2015-07-22 21:59:37 UTC 
bugbot adjusting priority
Comment 3 Johannes Segitz 2017-08-09 16:02:01 UTC 
not maintained in SLES anymore, fixed in openSUSE