GHSA-hfgr-h3vc-p6c2MediumCVSS 4.3

DockerSpawner allows any image by default

Published
December 8, 2023
Last Modified
December 13, 2023

🔗 CVE IDs covered (1)

CVE-2023-48311 →

📋 Description

Impact

Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowed_images configuration allow users to launch any pullable image, instead of restricting to only the single configured image, as intended.

Patches

Upgrade to DockerSpawner 13.

Workarounds

Explicitly setting DockerSpawner.allowed_images to a non-empty list containing only the default image will result in the intended default behavior:

c.DockerSpawner.image = "your-image"
c.DockerSpawner.allowed_images = ["your-image"]

🎯 Affected products1

  • pip/dockerspawner:>= 0.11.0, < 13.0.0

🔗 References (4)