# CVE-2022-29238: jupyter-notebook: Jupyter Notebook is a web-based notebook environment for interactive computing

CVE-2022-29238 is fixed in 2 products on 1 platform, first by jupyter-notebook 6.0.3-2ubuntu0.1, released June 14, 2022. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-29238
- Priority: Routine
- CVSS: 4.3 (Medium)
- EPSS: 0.0116
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 14, 2022

## Description

Jupyter Notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.12, authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed. Because fully authenticated requests are required, this is of relatively low impact. But if a server's root directory contains sensitive files whose only protection from the server is being hidden (e.g. `~/.ssh` while serving $HOME), then any authenticated requests could access files if their names are guessable. Such contexts also necessarily have full access to the server and therefore execution permissions, which also generally grants access to all the same files. So this does not generally result in any privilege escalation or increase in information access, only an additional, unintended means by which the files could be accessed. Version 6.4.12 contains a patch for this issue. There are currently no known workarounds.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | jupyter-notebook Debian 12.15 (bookworm) | 6.4.12-1 | [DEBIAN-CVE-2022-29238](https://patchblox.com/security/data/fix/linux/debian-cve-2022-29238.md) | Jun 14, 2022 |
| Linux | jupyter-notebook Debian 13.5 (trixie) | 6.4.12-1 | [DEBIAN-CVE-2022-29238](https://patchblox.com/security/data/fix/linux/debian-cve-2022-29238.md) | Jun 14, 2022 |
| Linux | jupyter-notebook Debian 14 | 6.4.12-1 | [DEBIAN-CVE-2022-29238](https://patchblox.com/security/data/fix/linux/debian-cve-2022-29238.md) | Jun 14, 2022 |
| Linux | jupyter-notebook Ubuntu 20.04 LTS (focal) | 6.0.3-2ubuntu0.1 | [jupyter-notebook 6.0.3-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-jupyter-notebook-6.0.3-2ubuntu0.1.md) | Jun 14, 2022 |
| Linux | jupyter-notebook Ubuntu 22.04.1 LTS (jammy) | 6.4.8-1ubuntu0.1 | [jupyter-notebook 6.4.8-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-jupyter-notebook-6.4.8-1ubuntu0.1.md) | Jun 14, 2022 |
| Linux | python3-notebook Ubuntu 20.04 LTS (focal) | 6.0.3-2ubuntu0.1 | [python3-notebook 6.0.3-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-python3-notebook-6.0.3-2ubuntu0.1.md) | Jun 14, 2022 |
| Linux | python3-notebook Ubuntu 22.04.1 LTS (jammy) | 6.4.8-1ubuntu0.1 | [python3-notebook 6.4.8-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-python3-notebook-6.4.8-1ubuntu0.1.md) | Jun 14, 2022 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.