CVE-2021-39159

描述

BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input could execute code in the BinderHub context, with the potential to egress credentials of the BinderHub deployment, including JupyterHub API tokens, kubernetes service accounts, and docker registry credentials. This may provide the ability to manipulate images and other user created pods in the deployment, with the potential to escalate to the host depending on the underlying kubernetes configuration. Users are advised to update to version 0.2.0-n653. If users are unable to update they may disable the git repo provider by specifying the `BinderHub.repo_providers` as a workaround.

如何修補 CVE-2021-39159

要修補 CVE-2021-39159,請將受影響套件升級到下列已修補版本。

• —升級至 0.2.0 或更新版本
• —升級至 195caac172690456dcdc8cc7a6ca50e05abf8182.patch 或更新版本

CVE-2021-39159 正在被利用嗎?

低 — EPSS 為 1.3%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 0.2.0
• from 0, < 195caac172690456dcdc8cc7a6ca50e05abf8182.patch | from 0, < 0.2.0-n653

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-39159
• PATCHgithub.com/jupyterhub/binderhub
• WEBgithub.com/jupyterhub/binderhub/commit/195caac172690456dcdc8cc7a6ca50e05abf8182
• WEBgithub.com/jupyterhub/binderhub/commit/195caac172690456dcdc8cc7a6ca50e05abf8182.patch