CVE-2023-48311

    Dashboard / Vulnerabilities / CVE-2023-48311

    CVE-2023-48311

    Published: 8 Dec 2023Last Modified: 28 Oct 2026

    Summary: Any image allowed by default

    Details: dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit `3ba4b665b` which has been included in dockerspawner release version 13. Users are advised to upgrade. Users unable to upgrade should explicitly set `DockerSpawner.allowed_images` to a non-empty list containing only the default image will result in the intended default behavior.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48311.json, https://github.com/jupyterhub/dockerspawner/security/advisories/GHSA-hfgr-h3vc-p6c2, https://nvd.nist.gov/vuln/detail/CVE-2023-48311, https://github.com/jupyterhub/dockerspawner/commit/3ba4b665b6ca6027ea7a032d7ca3eab977574626

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 4b9b86deae2bcf44fb4fc0feb535997a4f0025fa
    Fixed -e54ecf4f36e9275ec1afb8993cd9736369c1b0da

    Affected versions

    12.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High