{"action":"Upgrade jupyterhub-kubespawner to 0.12.0 or later.","affected":[{"fixed":"0.12.0","introduced":"0"}],"component":"jupyterhub-kubespawner","cve_ids":["CVE-2020-15110"],"ecosystem":"PyPI","epss":0.01114,"exploited":false,"fixed_versions":["0.12.0"],"ghsa_id":"GHSA-v7m9-9497-p9gr","id":"tcs_01M5KGAQFT9ZP82JWX8582SG98","modified_at":"2023-11-08T04:02:29.550274Z","published_at":"2020-07-17T21:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-51","https://github.com/jupyterhub/kubespawner/security/advisories/GHSA-v7m9-9497-p9gr","https://github.com/jupyterhub/kubespawner/commit/3dfe870a7f5e98e2e398b01996ca6b8eff4bb1d0"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-51","url":"https://osv.dev/vulnerability/PYSEC-2020-51"}],"summary":"In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. Th"}