CVE-2023-48311

Summary

CVE-2023-48311 affects Dockerspawner, a tool used to launch JupyterHub single user servers in Docker containers. Starting from version 0.11.0, Dockerspawner allows users to pull and launch any image instead of being restricted to the single configured image as intended. This vulnerability has been addressed in commit `3ba4b665b` and is now included in Dockerspawner release version 13. It is strongly recommended that users upgrade to the latest version to mitigate this issue. For those unable to upgrade, setting `DockerSpawner.allowed_images` to a non-empty list containing only the default image will restore the intended behavior.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.