Lack of data validation In dockerspawner
Description
DockerSpawner allows any image by default
Impact
Users of JupyterHub deployments running DockerSpawner starting with 0.11.0 without specifying DockerSpawner.allowed_images configuration allow users to launch any pullable image, instead of restricting to only the single configured image, as intended.
Patches
Upgrade to DockerSpawner 13.
Workarounds
Explicitly setting DockerSpawner.allowed_images to a non-empty list containing only the default image will result in the intended default behavior:
c.DockerSpawner.image = "your-image" c.DockerSpawner.allowed_images = ["your-image"]
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 pypi | 13.0.0 |
Aliases
1. 2. 3. 4. 5.
References
1. 2.