JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to     versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own     privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is     already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is     equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to     the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g.
    `groups` permissions from granting themselves or other users permissions via group membership, which is     intentional. Versions 4.1.6 and 5.1.0 fix this issue. (CVE-2024-41942)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to
    versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own
    privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is
    already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is
    equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to
    the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g.
    `groups` permissions from granting themselves or other users permissions via group membership, which is
    intentional. Versions 4.1.6 and 5.1.0 fix this issue. (CVE-2024-41942)

ID	Name	Product	Family	Type	Severity
228419	Linux Distros Unpatched Vulnerability : CVE-2024-41942	Nessus	Misc.	Local	high
413537	SCA: security update for jupyterhub (GHSA-9x4q-3gxw-849f)	Tenable Cloud Security	SCA Checks	Local	high
413537	SCA: security update for jupyterhub (GHSA-9x4q-3gxw-849f)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2024-41942

high

Tenable Plugins

high

high

high