CVE-2020-26261: JupyterHub-Systemdspawner - User-Readable API Tokens in Systemd Units
Summary
CVE-2020-26261: user-readable api tokens in systemd units for JupyterHub. Affects jupyterhub-systemdspawner versions < 0.15.0. Fixed in 0.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JupyterHub-Systemdspawner is a package available on PyPI that is commonly used in JupyterHub deployments. It provides a spawner for JupyterHub that uses systemd units to manage single-user servers. Systemd units are used to define and manage system services in Linux distributions. JupyterHub-Systemdspawner allows users to launch and manage their own Jupyter notebook servers within a JupyterHub environment.
Vulnerability Detail
The vulnerability identified as CVE-2020-26261 involves the exposure of user-readable API tokens in systemd units for JupyterHub. These API tokens, which are issued to single-user servers, are specified in the environment of systemd units. Unfortunately, these tokens are accessible to all users on the system, potentially leading to unauthorized access and misuse of the tokens. This vulnerability affects the-littlest-jupyterhub, which utilizes systemdspawner by default. The issue has been assigned a CVSS score of 7.9, indicating a high severity level.
How To Fix
Minimum fixed version
0.15.0
This is the first release that contains the fix.
pip install --upgrade "jupyterhub-systemdspawner==0.15.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability other than upgrading to systemdspawner v0.15 or later.
Conclusion
In conclusion, the vulnerability CVE-2020-26261 exposes user-readable API tokens in systemd units for JupyterHub deployments using the-littlest-jupyterhub. To mitigate this vulnerability, it is crucial to upgrade to systemdspawner v0.15 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jupyterhub-systemdspawner →
FAQ
The vulnerability allows all users on the system to access user-readable API tokens, potentially leading to unauthorized access and misuse of these tokens.
The vulnerability affects jupyterhub-systemdspawner, specifically versions prior to 0.15.
To fix this vulnerability, upgrade systemdspawner to version 0.15 or later.
No, the only known solution is to upgrade to systemdspawner v0.15 or later.
For more information, you can visit the Jupyter forum or contact security@ipython.org.
