Vulnerability · Published Dec 8, 2023 · Assigned by GitHub_M
CVE-2023-48311Any image allowed by default
High 8.0
In plain English
A high-severity improper input validation in dockerspawner from jupyterhub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit `3ba4b665b` which has been included in dockerspawner release version 13. Users are advised to upgrade. Users unable to upgrade should explicitly set `DockerSpawner.allowed_images` to a non-empty list containing only the default image will result in the intended default behavior.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | dockerspawner | 13.0.0 | GHSA-hfgr-h3vc-p6c2 |
| PyPI | dockerspawner | 13.0.0 | PYSEC-2026-1312 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jupyterhub | dockerspawner | >= 0.11.0, < 13.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H