Tóm tắt nhanh
- CVE-2023-48311 là lỗ hổng mức TRUNG BÌNH (CVSS 4.3) ảnh hưởng dockerspawner, dockerspawner (jupyter).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.64%, cao hơn 50.6% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 13.0.0, 13.0 hoặc mới hơn.
Mô tả
Impact
Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowed_images configuration allow users to launch any pullable image, instead of restricting to only the single configured image, as intended.
Patches
Upgrade to DockerSpawner 13.
Workarounds
Explicitly setting DockerSpawner.allowed_images to a non-empty list containing only the default image will result in the intended default behavior:
c.DockerSpawner.image = "your-image"
c.DockerSpawner.allowed_images = ["your-image"]
Mô tả của NVD
dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit `3ba4b665b` which has been included in dockerspawner release version 13. Users are advised to upgrade. Users unable to upgrade should explicitly set `DockerSpawner.allowed_images` to a non-empty list containing only the default image will result in the intended default behavior.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí