PT-2023-30774 · Unknown · Jupyterhub+1

CVE-2023-48311 · Publicado 2023-12-08 · Atualizado 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DockerSpawner versions 0.11.0 through 12

Description The issue affects JupyterHub deployments running DockerSpawner, allowing users to launch any pullable Docker image instead of restricting to the single configured image. This has been addressed in DockerSpawner release version 13. Users are advised to upgrade to this version to resolve the issue. For users unable to upgrade, setting DockerSpawner.allowed images to a non-empty list containing only the default image will result in the intended default behavior.

Recommendations For DockerSpawner versions 0.11.0 through 12, upgrade to DockerSpawner 13 to resolve the issue. As a temporary workaround for users unable to upgrade, explicitly set DockerSpawner.allowed images to a non-empty list containing only the default image, for example: c.DockerSpawner.image = "your-image" c.DockerSpawner.allowed images = ["your-image"]

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-48311

GHSA-HFGR-H3VC-P6C2

PYSEC-2026-1312

Produtos afetados

Dockerspawner

Jupyterhub

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48311.json · Exploit
• https://github.com/jupyterhub/dockerspawner/commit/3ba4b665b6ca6027ea7a032d7ca3eab977574626 · Correção
• https://github.com/jupyterhub/dockerspawner/security/advisories/GHSA-hfgr-h3vc-p6c2 · Aviso do Fabricante
• https://github.com/jupyterhub/dockerspawner · Nota
• https://twitter.com/VulmonFeeds/status/1733238183511376044 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1733222058249900494 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-hfgr-h3vc-p6c2 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2026-1312 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-48311 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-48311 · Aviso do Fabricante
• https://github.com/advisories/GHSA-hfgr-h3vc-p6c2 · Nota
• https://pypi.org/project/dockerspawner · Nota
• https://t.me/cvenotify/63532 · Publicação no Telegram