CVE-2020-26261

Description

jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15

How to fix CVE-2020-26261

To remediate CVE-2020-26261, upgrade the affected package to a fixed version below.

• —upgrade to 0.15.0 or later
• —upgrade to a4d08fd2ade1cfd0ef2c29dc221e649345f23580 or later

Is CVE-2020-26261 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 0.15.0
• from 0, < a4d08fd2ade1cfd0ef2c29dc221e649345f23580 | from 0, < 0.15.0

CVSS scores

References (8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-26261
• PATCHgithub.com/jupyterhub/systemdspawner
• PATCHpypi.org/project/jupyterhub-systemdspawner/
• WEBgithub.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015