| Package | Affected versions | Patched versions |
|---|---|---|
| jupyterhub-systemdspawner | < 0.15.0 | 0.15.0 |
| systemdspawner | < 0.15 | 0.15 |
user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.
In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.
Patched in jupyterhub-systemdspawner v0.15
No workaround other than upgrading systemdspawner to 0.15
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free