CVE-2020-26261: user-readable api tokens in systemd units
Impact user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.
In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.
Patches Patched in jupyterhub-systemdspawner v0.15
Workarounds No workaround other than upgrading systemdspawner to 0.15
For more information
If you have any questions or comments about this advisory: Open a thread in the Jupyter forum Email us at security@ipython.org
Other sources
JupyterHub systemdspawner could allow a local authenticated attacker to bypass security restrictions, caused by improper access control to the API tokens. By sending a specially-crafted request, an attacker could exploit this vulnerability to send arbitrary API requests.
— IBM
jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-26261?
CVE-2020-26261 is a vulnerability in jupyterhub-systemdspawner that allows unauthorized access to user API tokens.
How does CVE-2020-26261 affect JupyterHub?
CVE-2020-26261 affects JupyterHub by incorrectly exposing user API tokens to all users.
What is the severity of CVE-2020-26261?
The severity of CVE-2020-26261 is high with a CVSS score of 7.9.
How can I fix CVE-2020-26261?
To fix CVE-2020-26261, update jupyterhub-systemdspawner to version 0.15 or newer.
Where can I find more information about CVE-2020-26261?
You can find more information about CVE-2020-26261 in the official GitHub repository of jupyterhub-systemdspawner.