PT-2020-14192 · Jupyterhub · Kubespawner+2

Jining Huang · Published 2020-07-17 · Updated 2021-11-18 · CVE-2020-15110

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions jupyterhub-kubespawner versions prior to 0.12

Description The issue allows certain usernames to craft particular server names, granting them access to the default server of other users with matching usernames. This affects JupyterHub deployments using KubeSpawner and enabled named servers, with authenticators that allow usernames with hyphens or other characters that require escape. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 0.12, upgrade to kubespawner 0.12 or zero-to-jupyterhub 0.9.1. As a temporary workaround for KubeSpawner, specify the configuration using the PatchedKubeSpawner class to modify pod name template and pvc name template, but remove this configuration after upgrading to ensure consistent naming.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-15110

GHSA-V7M9-9497-P9GR

PYSEC-2020-51

Affected Products

Jupyterhub-Kubespawner

Kubespawner

Zero-To-Jupyterhub

References · 8

• 🔥 https://github.com/jupyterhub/kubespawner/security/advisories/GHSA-v7m9-9497-p9gr · Exploit
• https://github.com/jupyterhub/kubespawner/commit/3dfe870a7f5e98e2e398b01996ca6b8eff4bb1d0 · Patch
• https://osv.dev/vulnerability/GHSA-v7m9-9497-p9gr · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-51 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15110 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15110 · Vendor Advisory
• https://github.com/jupyterhub/kubespawner · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub-kubespawner/PYSEC-2020-51.yaml · Note