p PatchFirst

CVE-2024-41942

CVE-2024-41942 · JupyterHub has a privilege escalation vulnerability with the `admin:users` scope

This page contains facts from public vulnerability sources. Check the original advisory before updating.

JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.

CVSS 7.2 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • jupyterhub

    Versions
    • < 4.1.6: Affected
    • >= 5.0.0, < 5.1.0: Affected

    No fix published

  • jupyterhub Debian:12

    Versions
    • 3.0.0+ds1-1
    • 5.0.0+ds1-1
    • 5.0.0+ds1-2
    • 5.0.0+ds1-3
    • 5.0.0+ds1-4
    • 5.2.1+ds1-1
    • 5.2.1+ds1-2
    • 5.2.1+ds1-3
    • 5.2.1+ds1-4
    • 5.2.1+ds1-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyterhub Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.2.1+ds1-1

    Update to 5.2.1+ds1-1

  • jupyterhub Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.2.1+ds1-1

    Update to 5.2.1+ds1-1

  • jupyterhub PyPI

    Versions
    • 0.1.0
    • 0.2.0
    • 0.3.0
    • 0.4.0
    • 0.4.1
    • 0.5.0
    • 0.6.0
    • 0.6.1
    • 0.7.0
    • 0.7.0b1
    • 0.7.1
    • 0.7.2
    • 0.8.0
    • 0.8.0b1
    • 0.8.0b2
    • 0.8.0b3
    • 0.8.0b4
    • 0.8.0b5
    • 0.8.0rc1
    • 0.8.0rc2
    • 0.8.1
    • 0.9.0
    • 0.9.0b1
    • 0.9.0b2
    • 0.9.0b3
    • 0.9.0rc1
    • 0.9.1
    • 0.9.2
    • 0.9.3
    • 0.9.4
    • 0.9.5
    • 0.9.6
    • 1.0.0
    • 1.0.0b1
    • 1.0.0b2
    • 1.1.0
    • 1.1.0b1
    • 1.2.0
    • 1.2.0b1
    • 1.2.1
    • 1.2.2
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 2.0.0
    • 2.0.0b1
    • 2.0.0b2
    • 2.0.0b3
    • 2.0.0rc1
    • 2.0.0rc2
    • 2.0.0rc3
    • 2.0.0rc4
    • 2.0.0rc5
    • 2.0.1
    • 2.0.2
    • 2.1.0
    • 2.1.1
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    • 2.3.1
    • 3.0.0
    • 3.0.0b1
    • 3.1.0
    • 3.1.1
    • 4.0.0
    • 4.0.0b1
    • 4.0.0b2
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 4.1.1
    • 4.1.2
    • 4.1.3
    • 4.1.4
    • 4.1.5
    Affected ranges
    • ECOSYSTEM: < 4.1.6

    Update to 4.1.6

  • jupyterhub PyPI

    Versions
    • 5.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.1.0

    Update to 5.1.0

  • jupyterhub PyPI

    Versions
    • 0.1.0
    • 0.2.0
    • 0.3.0
    • 0.4.0
    • 0.4.1
    • 0.5.0
    • 0.6.0
    • 0.6.1
    • 0.7.0
    • 0.7.0b1
    • 0.7.1
    • 0.7.2
    • 0.8.0
    • 0.8.0b1
    • 0.8.0b2
    • 0.8.0b3
    • 0.8.0b4
    • 0.8.0b5
    • 0.8.0rc1
    • 0.8.0rc2
    • 0.8.1
    • 0.9.0
    • 0.9.0b1
    • 0.9.0b2
    • 0.9.0b3
    • 0.9.0rc1
    • 0.9.1
    • 0.9.2
    • 0.9.3
    • 0.9.4
    • 0.9.5
    • 0.9.6
    • 1.0.0
    • 1.0.0b1
    • 1.0.0b2
    • 1.1.0
    • 1.1.0b1
    • 1.2.0
    • 1.2.0b1
    • 1.2.1
    • 1.2.2
    • 1.3.0
    • 1.4.0
    • 1.4.1
    • 1.4.2
    • 1.5.0
    • 1.5.1
    • 2.0.0
    • 2.0.0b1
    • 2.0.0b2
    • 2.0.0b3
    • 2.0.0rc1
    • 2.0.0rc2
    • 2.0.0rc3
    • 2.0.0rc4
    • 2.0.0rc5
    • 2.0.1
    • 2.0.2
    • 2.1.0
    • 2.1.1
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    • 2.3.1
    • 3.0.0
    • 3.0.0b1
    • 3.1.0
    • 3.1.1
    • 4.0.0
    • 4.0.0b1
    • 4.0.0b2
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 4.1.1
    • 4.1.2
    • 4.1.3
    • 4.1.4
    • 4.1.5
    Affected ranges
    • {"events": [{"introduced": "0"}, {"fixed": "99e2720b0fc626cbeeca3c6337f917fdacfaa428"}, {"fixed": "ff2db557a85b6980f90c3158634bf924063ab8ba"}], "repo": "https://github.com/jupyterhub/jupyterhub", "type": "GIT"}
    • ECOSYSTEM: < 4.1.6

    Update to 4.1.6

  • jupyterhub Ubuntu:22.04:LTS

    Versions
    • 2.0.0+ds1-1
    • 2.0.0+ds1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyterhub Ubuntu:24.04:LTS

    Versions
    • 3.0.0+ds1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyterhub Ubuntu:25.10

    Versions
    • 5.2.1+ds1-2
    • 5.2.1+ds1-3
    • 5.2.1+ds1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyterhub Ubuntu:26.10

    Versions
    • 5.2.1+ds1-4
    • 5.2.1+ds1-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyterhub Ubuntu:26.04:LTS

    Versions
    • 5.2.1+ds1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →