[IPython-dev] CVE Request: Enforce use of HTTPS for MathJax in IPython

Kyle Kelley rgbkrk at gmail.com
Fri Aug 1 00:23:18 EDT 2014


We would like to request a CVE for a vulnerability in the IPython notebook,
reported today by Leopold Schabel on IPython's GitHub issue tracker at

Email address of requester: security at ipython.org; rgbkrk at gmail.com
Software name: IPython notebook
Type of vulnerability: Use of insecure resources
Attack outcome: Remote execution
Patch/issue: https://github.com/ipython/ipython/pull/6249,
Affected versions: 0.12 ≤ version ≤ 2.1

Summary: When using the IPython notebook without encryption (i.e. running
the server on HTTP instead of HTTPS), mathjax is loaded over HTTP. An
attacker with fortuitous network position could execute code on a local
IPython notebook by modifying the mathjax javascript.

This issue was fixed in the git master branch (development branch for
upcoming v. 2.2) with commit cf793ebc4, on 7/31/2014:


* Run the notebook with SSL (see
* Install mathjax
    from IPython.external.mathjax import install_mathjax


Kyle Kelley
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/ipython-dev/attachments/20140731/b60923ec/attachment.html>

More information about the IPython-dev mailing list