CVE-2020-26261
Summary
| CVE | CVE-2020-26261 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-12-09 17:15:00 UTC |
|---|
| Updated | 2020-12-10 21:46:00 UTC |
|---|
| Description | jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15 |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| jupyterhub-systemdspawner · PyPI |
MISC |
pypi.org |
Product, Third Party Advisory |
| systemdspawner/CHANGELOG.md at master · jupyterhub/systemdspawner · GitHub |
MISC |
github.com |
Release Notes, Third Party Advisory |
| user-readable api tokens in systemd units · Advisory · jupyterhub/systemdspawner · GitHub |
CONFIRM |
github.com |
Third Party Advisory |
| Merge pull request from GHSA-cg54-gpgr-4rm6 · jupyterhub/systemdspawner@a4d08fd · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 983224 Python (pip) Security Update for jupyterhub-systemdspawner (GHSA-cg54-gpgr-4rm6)
