En resumen
- CVE-2020-26261 es una vulnerabilidad ALTO (CVSS 7.9) que afecta a jupyterhub-systemdspawner, systemdspawner (jupyterhub).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.48%, mayor que el 41.6% de las vulnerabilidades.
- Solución: actualizar a 0.15.0, 0.15 o posterior.
Description
Impact
user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.
In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.
Patches
Patched in jupyterhub-systemdspawner v0.15
Workarounds
No workaround other than upgrading systemdspawner to 0.15
For more information
If you have any questions or comments about this advisory:
NVD description
jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free