CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
30.1%
What kind of vulnerability is it? Who is impacted?
JupyterHub deployments using:
user-hyphen
or user@email
), anduser
in the above cases)In this circumstance, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames.
Has the problem been patched? What versions should users upgrade to?
Patch will be released in kubespawner 0.12 and zero-to-jupyterhub 0.9.1
Is there a way for users to fix or remediate the vulnerability without upgrading?
Specify configuration:
for KubeSpawner
from traitlets import default
from kubespawner import KubeSpawner
class PatchedKubeSpawner(KubeSpawner):
@default("pod_name_template")
def _default_pod_name_template(self):
if self.name:
return "jupyter-{username}-{servername}"
else:
return "jupyter-{username}"
@default("pvc_name_template")
def _default_pvc_name_template(self):
if self.name:
return "claim-{username}-{servername}"
else:
return "claim-{username}"
c.JupyterHub.spawner_class = PatchedKubeSpawner
Note for KubeSpawner: this configuration will behave differently before and after the upgrade, so will need to be removed when upgrading. Only apply this configuration while still using KubeSpawner ≤ 0.11.1 and remove it after upgrade to ensure consistent pod and pvc naming.
Changing the name template means pvcs for named servers will have different names. This will result in orphaned PVCs for named servers across Hub upgrade! This may appear as data loss for users, depending on configuration, but the orphaned PVCs will still be around and data can be migrated manually (or new PVCs created manually to reference existing PVs) before deleting the old PVCs and/or PVs.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Credit: Jining Huang
Vendor | Product | Version | CPE |
---|---|---|---|
jupyterhub | kubespawner | * | cpe:2.3:a:jupyterhub:kubespawner:*:*:*:*:*:*:*:* |
github.com/advisories/GHSA-v7m9-9497-p9gr
github.com/jupyterhub/kubespawner/commit/3dfe870a7f5e98e2e398b01996ca6b8eff4bb1d0
github.com/jupyterhub/kubespawner/security/advisories/GHSA-v7m9-9497-p9gr
github.com/pypa/advisory-database/tree/main/vulns/jupyterhub-kubespawner/PYSEC-2020-51.yaml
nvd.nist.gov/vuln/detail/CVE-2020-15110
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
Percentile
30.1%