CVE-2023-48311 - CVE House
Back to Database
Status published High CVE-2023-48311

Any image allowed by default

Vulnerability Description

dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying `DockerSpawner.allowed_images` configuration allow users to launch _any_ pullable docker image, instead of restricting to only the single configured image, as intended. This issue has been addressed in commit `3ba4b665b` which has been included in dockerspawner release version 13. Users are advised to upgrade. Users unable to upgrade should explicitly set `DockerSpawner.allowed_images` to a non-empty list containing only the default image will result in the intended default behavior.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-48311

Credits & Attribution

No credits recorded in the NVD database.

References

More from jupyterhub

View All →
CVE-2025-32428
Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended
Critical 9
CVE-2024-41942
JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
High 7.2
CVE-2024-37300
Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0
High 8.1
CVE-2024-35225
Jupyter Server Proxy has a reflected XSS issue in host parameter
Critical 9.7
CVE-2024-29033
GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace
High 7.5

Affected Vendor

Affected Software

dockerspawner
Vulnerable Versions:
>= 0.11.0, < 13.0

Timeline

Official Publish: December 8th, 2023
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact