CVE-2020-26261PYSEC-2020-52GHSA-CG54-GPGR-4RM6
user-readable api tokens in systemd units
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.15, 0.15.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
Timeline
- CVE published
- Record last updated
Affected versions
- jupyterhub systemdspawner
fixed in 0.15
- jupyterhub-systemdspawnerPyPI
fixed in 0.15.0
- jupyterhub-systemdspawnerPyPI
fixed in 0.15.0