Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

binderhub

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.4PyPIAmendedPublished

    remote code execution via git repo provider

    CVE-2021-39159 · GHSA-9jjr-qqfp-ppwx

    Affected
    • PyPI binderhub < 0.2.0
    Fixed in
    0.2.0· Vendor fix available
    Issue
    Impact A remote code execution vulnerability has been identified in BinderHub, where providing BinderHub with maliciously crafted input could execute code in the BinderHub context, with the potential to egress credentials of the BinderHub deployment, including JupyterHub API tokens, kubernetes service accounts, and docker registry credentials. This may provide the ability to manipulate images and other user created pods in the deployment, with the potential to escalate to the host depending on the underlying kubernetes configuration. Patches Patch below, or on GitHub Workarounds Disable the git repo provider by specifying the BinderHub.repoproviders config, e.g.: References Credit: Jose Carlos Luna Duran (CERN) and Riccardo Castellotti (CERN). For more information If you have any questions or comments about this advisory: Email us at security@ipython.org

    Recommended action: Upgrade to 0.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →