Affected: jupyterhub kubespawner

In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12.

Affected: PyPI: jupyterhub-kubespawner

### Impact _What kind of vulnerability is it? Who is impacted?_

JupyterHub deployments using:

- KubeSpawner <= 0.11.1 (e.g. zero-to-jupyterhub 0.9.0) and - enabled named_servers (not default), and - an Authenticator that allows: - usernames with hyphens or other characters that require escape (e.g. `user-hyphen` or `user@email`), and - usernames which may match other usernames up to but not including the escaped character (e.g. `user` in the above cases)

In this circumstance, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames.

### Patches _Has the problem been patched? What versions should users upgrade to?_

Patch will be released in kubespawner 0.12 and zero-to-jupyterhub 0.9.1

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

#### KubeSpawner

Specify configuration:

for KubeSpawner ```python from traitlets import default from kubespawner import KubeSpawner

class PatchedKubeSpawner(KubeSpawner): @default("pod_name_template") def _default_pod_name_template(self): if self.name: return "jupyter-{username}-{servername}" else: return "jupyter-{username}"

@default("pvc_name_template") def _default_pvc_name_template(self): if self.name: return "claim-{username}-{servername}" else: return "claim-{username}"

c.JupyterHu…