CVE-2020-26261

Advisory

Jupyterhub-systemdspawner 0.15 includes a fix for CVE-2020-26261: In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26261
• https://github.com/jupyterhub/systemdspawner/security/advisories/GHSA-cg54-gpgr-4rm6
• https://github.com/jupyterhub/systemdspawner/commit/a4d08fd2ade1cfd0ef2c29dc221e649345f23580
• https://pypi.org/project/jupyterhub-systemdspawner/
• https://github.com/jupyterhub/systemdspawner/blob/master/CHANGELOG.md#v015