PT-2021-4499 · Binderhub · Binderhub

Jose Carlos Luna Duran + 1 · Published 2021-08-25 · Updated 2022-10-25 · CVE-2021-39159

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BinderHub versions prior to 0.2.0-n653

Description A remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input could execute code in the BinderHub context, with the potential to egress credentials of the BinderHub deployment, including JupyterHub API tokens, kubernetes service accounts, and docker registry credentials. This may provide the ability to manipulate images and other user created pods in the deployment, with the potential to escalate to the host depending on the underlying kubernetes configuration.

Recommendations Update to version 0.2.0-n653. As a temporary workaround, consider disabling the git repo provider by specifying the BinderHub.repo providers.

Fix

OS Command Injection

Code Injection

Weakness Enumeration

CWE-78

CWE-94

Related Identifiers

BDU:2021-05133

CVE-2021-39159

GHSA-9JJR-QQFP-PPWX

PYSEC-2021-371

Affected Products

Binderhub

References · 12

• https://github.com/jupyterhub/binderhub/security/advisories/GHSA-9jjr-qqfp-ppwx · Patch
• https://github.com/jupyterhub/binderhub/commit/195caac172690456dcdc8cc7a6ca50e05abf8182.patch · Patch
• https://osv.dev/vulnerability/CVE-2021-39159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39159 · Security Note
• https://osv.dev/vulnerability/GHSA-9jjr-qqfp-ppwx · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-371 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05133 · Security Note
• https://github.com/jupyterhub/binderhub · Note
• https://github.com/jupyterhub/binderhub/commit/195caac172690456dcdc8cc7a6ca50e05abf8182 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/binderhub/PYSEC-2021-371.yaml · Note
• https://t.me/cvenotify/20080 · Telegram Post
• https://t.me/cvenotify/20501 · Telegram Post