In breve
- CVE-2020-26261 è una vulnerabilità ALTO (CVSS 7.9) che riguarda jupyterhub-systemdspawner, systemdspawner (jupyterhub).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.48%, superiore al 41.6% delle vulnerabilità.
- Correzione: aggiornare a 0.15.0, 0.15 o successiva.
Description
Impact
user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.
In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.
Patches
Patched in jupyterhub-systemdspawner v0.15
Workarounds
No workaround other than upgrading systemdspawner to 0.15
For more information
If you have any questions or comments about this advisory:
NVD description
jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free