PT-2018-17948 · Gitlab+1 · Gitlab+1

Publicado 2018-02-18 · Atualizado 2022-05-13 · CVE-2018-7206

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Project Jupyter JupyterHub OAuthenticator versions 0.6.x through 0.6.1 Project Jupyter JupyterHub OAuthenticator versions 0.7.x through 0.7.2

Description An issue was discovered in JupyterHub OAuthenticator when using GitLab group whitelisting for access control. Group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab group whitelist is unaffected.

Recommendations For Project Jupyter JupyterHub OAuthenticator versions 0.6.x through 0.6.1, update to version 0.6.2 or later. For Project Jupyter JupyterHub OAuthenticator versions 0.7.x through 0.7.2, update to version 0.7.3 or later.

Correção

Identificadores relacionados

CVE-2018-7206

GHSA-8X3M-M3X9-54FJ

PYSEC-2018-68

Produtos afetados

Gitlab

Jupyterhub Oauthenticator

Referências · 11

• https://github.com/jupyterhub/oauthenticator · Nota
• https://github.com/jupyterhub/oauthenticator/blob/8499dc2/CHANGELOG.md#073---2018-02-16 · Aviso do Fabricante
• https://github.com/jupyterhub/oauthenticator/commit/1845c0e4b1bff3462c91c3108c85205acd3c75a2 · Correção
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2018-151.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/oauthenticator/PYSEC-2018-68.yaml · Nota
• https://osv.dev/vulnerability/CVE-2018-7206 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7206 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2018-68 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8x3m-m3x9-54fj · Aviso do Fabricante
• https://github.com/advisories/GHSA-8x3m-m3x9-54fj · Nota
• https://blog.jupyter.org/security-fix-for-jupyterhub-gitlab-oauthenticator-7b14571d1f76 · Nota