Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

dockerspawner

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3PyPIAmendedPublished

    DockerSpawner allows any image by default

    CVE-2023-48311 · GHSA-hfgr-h3vc-p6c2

    Affected
    • PyPI dockerspawner >= 0.11.0, < 13.0.0
    Fixed in
    13.0.0· Vendor fix available
    Issue
    Impact Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowedimages configuration allow users to launch any pullable image, instead of restricting to only the single configured image, as intended. Patches Upgrade to DockerSpawner 13. Workarounds Explicitly setting DockerSpawner.allowedimages to a non-empty list containing only the default image will result in the intended default behavior:

    Recommended action: Upgrade to 13.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →