CVE-2024-41942: jupyter jupyterhub
Vulnerability summary
CVE-2024-41942 is a high (CVSS 7.2) vulnerability in jupyter jupyterhub. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 47.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 08-08-2024PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · PypiEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.59%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
0.00 pp
From 0.59% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard1 product
- py3-jupyterhub< 5.1.0-r0
Debian1 product
- jupyterhubAll versions (No fix recorded) | < 5.2.1+ds1-1
Jupyter1 product
- jupyterhub< 4.1.6 | 5.0.0 | 5.0.0:beta1 | 5.0.0:beta2
Jupyterhub1 product
- jupyterhub< 4.1.6 | ≥ 5.0.0, < 5.1.0
PyPI1 product
- jupyterhub≥ 5.0.0, < 5.1.0 | < ff2db557a85b6980f90c3158634bf924063ab8ba | < 4.1.6
Ubuntu1 product
- jupyterhubAll versions (No fix recorded)
Wolfi1 product
- py3-jupyterhub< 5.1.0-r0
7 vendors · 7 products
References
10 links- github.com/jupyterhub/jupyterhub/security/advisories/GHSA-9x4q-3gxw-849fX Refsource CONFIRMWEBAdvisoryREPORTThird Party Advisory
- github.com/jupyterhub/jupyterhub/commit/99e2720b0fc626cbeeca3c6337f917fdacfaa428X Refsource MISCWEBFIXREPORTPatch
- github.com/jupyterhub/jupyterhub/commit/ff2db557a85b6980f90c3158634bf924063ab8baX Refsource MISCWEBFIXREPORTPatch
