| Package | Affected versions | Patched versions |
|---|---|---|
| dockerspawner | ≥ 0.11.0, < 13.0.0 | 13.0.0 |
| dockerspawner | ≥ 0.11.0, < 13.0 | 13.0 |
Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowed_images configuration allow users to launch any pullable image, instead of restricting to only the single configured image, as intended.
Upgrade to DockerSpawner 13.
Explicitly setting DockerSpawner.allowed_images to a non-empty list containing only the default image will result in the intended default behavior:
c.DockerSpawner.image = "your-image"
c.DockerSpawner.allowed_images = ["your-image"]
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free