Impact
What kind of vulnerability is it? Who is impacted?
user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.
In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.
Patches
Has the problem been patched? What versions should users upgrade to?
Patched in jupyterhub-systemdspawner v0.15
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
No workaround other than upgrading systemdspawner to 0.15
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
quentinmit Analyst
Impact
What kind of vulnerability is it? Who is impacted?
user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users.
In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.
Patches
Has the problem been patched? What versions should users upgrade to?
Patched in jupyterhub-systemdspawner v0.15
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
No workaround other than upgrading systemdspawner to 0.15
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory: