jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| jupyterhub-systemdspawner(PyPI) | 0 | 0.15.0 | N/A |
CVSS Metrics
