Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNnNTQtZ3Bnci00cm02

user-readable api tokens in systemd units for JupyterHub

Impact

user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.

In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.

Patches

Patched in jupyterhub-systemdspawner v0.15

Workarounds

No workaround other than upgrading systemdspawner to 0.15

For more information

If you have any questions or comments about this advisory:

• Open a thread in the Jupyter forum
• Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-cg54-gpgr-4rm6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWNnNTQtZ3Bnci00cm02
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 4 years ago
Updated: over 1 year ago

CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Identifiers: GHSA-cg54-gpgr-4rm6, CVE-2020-26261
References:

• https://github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6
• https://github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580
• https://github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015
• https://pypi.org/project/jupyterhub-systemdspawner/
• https://nvd.nist.gov/vuln/detail/CVE-2020-26261
• https://github.com/advisories/GHSA-cg54-gpgr-4rm6

Repository: https://github.com/jupyterhub/systemdspawner
Blast Radius: 7.0

Affected Packages