JupyterHub Fixes Privilege Escalation Vulnerability

CVE-2024-41942

What is CVE-2024-41942?

JupyterHub software, designed to facilitate multi-user access to Jupyter notebooks, is affected by a vulnerability that allows users with the highly privileged 'admin:users' scope to escalate their privileges to become full admin users. This issue is present in versions prior to 4.1.6 and 5.1.0. Consequently, trusted users inadvertently granted this scope could assume unrestricted permissions that were not intended. While this vulnerability primarily affects the built-in admin role, it does not prevent other types of privilege grants through group memberships, highlighting the necessity for careful permission management.

References