How to Fix CVE-2024-28233 in 1.x
arnozhai opened this issue · comments
We are still using 1.x versions for some special reasons.
from GHSA-7r3h-4ph8-w38g
I got suggestions for earlier JupyterHub versions :
deploy jupyterhub on its own domain, not shared with any other services
enable per-user domains via c.JupyterHub.subdomain_host = "https://mydomain.example.org"
It doesn't suit me.
If there is no plan to fix it in 1.x, how do I go about fixing it myself?
Thank you for opening your first issue in this project! Engagement like this is essential for open source projects! 🤗
If you haven't done so already, check out Jupyter's Code of Conduct. Also, please try to follow the issue template as it helps other other community members to contribute more effectively.
You can meet the other Jovyans by joining our Discourse forum. There is also an intro thread there where you can stop by and say Hi! 👋
Welcome to the Jupyter community! 🎉
The fix required significant effort and required updates from software in user environments as well to be compatible. I think you are simply becoming forced to upgrade then =/