CVE-2020-36191:
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).
Depends on packages which need a new maintainer
normal
The packages that jupyterhub depends on which need a new maintainer are:
The WNPP database contains an ITP (Intent To Package) entry for
this package. This is probably an error, as it has already been
packaged. Please see bug number #988775 for more information.
Standards version of the package is outdated.
wishlist
The package should be updated to follow the last version of Debian Policy
(Standards-Version 4.6.0 instead of
4.5.1).
![[bug history graph]](https://qa.debian.org/data/bts/graphs/j/jupyterhub.png){kind=link}