In short
- CVE-2020-26261 is a HIGH (CVSS 7.9) vulnerability affecting jupyterhub-systemdspawner, systemdspawner (jupyterhub).
- Chance of exploitation in the next 30 days (EPSS): 0.48%, higher than 41.6% of all vulnerabilities.
- Fix: update to 0.15.0, 0.15 or later.
Description
Impact
user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.
In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.
Patches
Patched in jupyterhub-systemdspawner v0.15
Workarounds
No workaround other than upgrading systemdspawner to 0.15
For more information
If you have any questions or comments about this advisory:
NVD description
jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free