PYSEC-2020-52
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/jupyterhub-systemdspawner/PYSEC-2020-52.yaml
- JSON Data
- https://api.test.osv.dev/v1/vulns/PYSEC-2020-52
- Aliases
- Published
- 2020-12-09T17:15:00Z
- Modified
- 2023-11-01T04:52:44.579829Z
- Summary
- [none]
- Details
-
jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
- References
-
- https://github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6
- https://github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580
- https://pypi.org/project/jupyterhub-systemdspawner/
- https://github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015
Affected packages
PyPI / jupyterhub-systemdspawner
Package
- Name
- jupyterhub-systemdspawner
- View open source insights on deps.dev
- Purl
- pkg:pypi/jupyterhub-systemdspawner