Em resumo
- CVE-2020-26261 é uma vulnerabilidade ALTO (CVSS 7.9) que afeta jupyterhub-systemdspawner, systemdspawner (jupyterhub).
- Chance de exploração nos próximos 30 dias (EPSS): 0.48%, maior que 41.6% das vulnerabilidades.
- Correção: atualize para 0.15.0, 0.15 ou posterior.
Description
Impact
user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.
In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.
Patches
Patched in jupyterhub-systemdspawner v0.15
Workarounds
No workaround other than upgrading systemdspawner to 0.15
For more information
If you have any questions or comments about this advisory:
NVD description
jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free