—

PYSEC-2020-52

Quick fix

PYSEC-2020-52 — jupyterhub-systemdspawner: upgrade to the fixed version with the command below.

pip install --upgrade 'jupyterhub-systemdspawner>=a4d08fd2ade1cfd0ef2c29dc221e649345f23580'

Details

jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/jupyterhub-systemdspawner

Introduced in: 0Fixed in: a4d08fd2ade1cfd0ef2c29dc221e649345f23580

Fixpip install --upgrade 'jupyterhub-systemdspawner>=a4d08fd2ade1cfd0ef2c29dc221e649345f23580'

References

https://github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6[ADVISORY]
https://github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580[FIX]
https://pypi.org/project/jupyterhub-systemdspawner/[PACKAGE]
https://github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015[WEB]