GitHub Advisoryadvisory · PyPI

GHSA-hfgr-h3vc-p6c2 DockerSpawner allows any image by default

MEDIUM Published 2023-12-08 Modified 2023-12-13 Official page ↗
Aliases
CVE-2023-48311
Ecosystem
PyPI
Packages
dockerspawner
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-20
Reviewed
2023-12-08

Affected packages

• PyPI dockerspawner: >= 0.11.0, < 13.0.0 → fixed in 13.0.0

Description

Impact Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable image, instead of restricting to only the single configured image, as intended. Patches Upgrade to DockerSpawner 13. Workarounds Explicitly setting `DockerSpawner.allowed_images` to a non-empty list containing only the default image will result in the intended default behavior: ```python c.DockerSpawner.image = "your-image" c.DockerSpawner.allowed_images = ["your-image"] ```

Related

Alias · CVE (1)

  • CVE-2023-48311 dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References