PT-2023-30774 · Unknown · Jupyterhub+1

Published 2023-12-08 · Updated 2023-12-13 · CVE-2023-48311

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DockerSpawner versions 0.11.0 through 12

Description The issue affects JupyterHub deployments running DockerSpawner, allowing users to launch any pullable Docker image instead of restricting to the single configured image. This has been addressed in DockerSpawner release version 13. Users are advised to upgrade to this version to resolve the issue. For users unable to upgrade, setting DockerSpawner.allowed images to a non-empty list containing only the default image will result in the intended default behavior.

Recommendations For DockerSpawner versions 0.11.0 through 12, upgrade to DockerSpawner 13 to resolve the issue. As a temporary workaround for users unable to upgrade, explicitly set DockerSpawner.allowed images to a non-empty list containing only the default image, for example: c.DockerSpawner.image = "your-image" c.DockerSpawner.allowed images = ["your-image"]

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-48311

GHSA-HFGR-H3VC-P6C2

Affected Products

Dockerspawner

Jupyterhub

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48311.json · Exploit
• https://github.com/jupyterhub/dockerspawner/security/advisories/GHSA-hfgr-h3vc-p6c2 · Vendor Advisory
• https://github.com/jupyterhub/dockerspawner/commit/3ba4b665b6ca6027ea7a032d7ca3eab977574626 · Patch
• https://osv.dev/vulnerability/CVE-2023-48311 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hfgr-h3vc-p6c2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48311 · Security Note
• https://github.com/jupyterhub/dockerspawner · Note
• https://t.me/cvenotify/63532 · Telegram Post
• https://twitter.com/CVEnew/status/1733222058249900494 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1733238183511376044 · Twitter Post