GHSA-7r3h-4ph8-w38g security advisory URL returns 404 error for CVE-2024-28233 fixed in 4.1.0 about jupyterhub

[krassowski]

so we can determine the severity and risk impact to our JupyterHub deployments

I do not know what this vulnerability is, but a rule of thumb I follow is: if maintainers decided to delay disclosure to allow deployments to upgrade, it is better to upgrade early than not. I am sure that the advisory will be published in due course though.

[minrk]

This is a fine way to open a discussion. Sorry for being unclear! I mentioned that the advisory will be published a week after the release to give packaging time to propagate and people time to upgrade, but I realize that same comment should have been in the changelog as well. It will be public tomorrow. At that point the CVE record will be updated, I believe.

If you have any specific questions, I'm happy to answer them. The advisory pertains generally to malicious users being able to attack each other, not vulnerabilities from outside.

[mattvw]

Great! Thanks for the clarification!