JupyterHub OAuthenticator elevation of privilege
High severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Sep 5, 2023
Package
Affected versions
>= 0.6, < 0.6.2
>= 0.7, < 0.7.3
Patched versions
0.6.2
0.7.3
Description
Published by the National Vulnerability Database
Feb 18, 2018
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Sep 12, 2022
Last updated
Sep 5, 2023
Credits
-
jhutchings1 Analyst
An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. (Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab_group_whitelist is unaffected. No other Authenticators are affected.)
References