CVE-2020-26261

Katalog CVE

CVSS 7.9 · High EPSS 0,48%

Kerentanan Exposure of Resource to Wrong Sphere pada jupyterhub systemdspawner. Skor CVSS 3.1 7.9 (High) menurut NVD.

Deskripsi (NVD)

jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15

Rincian

Terbit di NVD

9 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.9 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-668: Exposure of Resource to Wrong Sphere

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580 patch · advisory pihak ketiga
• https://github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015 release notes · advisory pihak ketiga
• https://github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6 advisory pihak ketiga
• https://pypi.org/project/jupyterhub-systemdspawner/ product · advisory pihak ketiga