PT-2020-16385 · Jupyterhub+1 · Jupyterhub-Systemdspawner+1

Published 2020-12-09 · Updated 2020-12-11 · CVE-2020-26261

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions jupyterhub-systemdspawner versions prior to 0.15

Description jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner, user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.

Recommendations For versions prior to 0.15, upgrade jupyterhub-systemdspawner to version 0.15 to resolve the issue. As a temporary workaround, consider restricting access to the environment of systemd units until a patch is available. No other workarounds are available other than upgrading systemdspawner to 0.15.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2020-26261

GHSA-CG54-GPGR-4RM6

PYSEC-2020-52

Affected Products

Jupyterhub-Systemdspawner

Systemd

References · 22

• https://github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26261 · Security Note
• https://osv.dev/vulnerability/GHSA-cg54-gpgr-4rm6 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-52 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26261 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub-systemdspawner/PYSEC-2020-52.yaml · Note
• https://github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015 · Note
• https://github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6 · Note
• https://github.com/jupyterhub/systemdspawner · Note
• https://t.me/cibsecurity/18187 · Telegram Post
• https://pypi.org/project/jupyterhub-systemdspawner · Note
• https://t.me/cibsecurity/18053 · Telegram Post
• https://t.me/cibsecurity/18092 · Telegram Post
• https://t.me/cibsecurity/18111 · Telegram Post
• https://t.me/cibsecurity/18072 · Telegram Post