PT-2018-17948 · Gitlab+1 · Gitlab+1

Published 2018-02-18 · Updated 2022-05-13 · CVE-2018-7206

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Project Jupyter JupyterHub OAuthenticator versions 0.6.x through 0.6.1 Project Jupyter JupyterHub OAuthenticator versions 0.7.x through 0.7.2

Description An issue was discovered in JupyterHub OAuthenticator when using GitLab group whitelisting for access control. Group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab group whitelist is unaffected.

Recommendations For Project Jupyter JupyterHub OAuthenticator versions 0.6.x through 0.6.1, update to version 0.6.2 or later. For Project Jupyter JupyterHub OAuthenticator versions 0.7.x through 0.7.2, update to version 0.7.3 or later.

Fix

Related Identifiers

CVE-2018-7206

GHSA-8X3M-M3X9-54FJ

PYSEC-2018-68

Affected Products

Gitlab

Jupyterhub Oauthenticator

References · 11

• https://github.com/jupyterhub/oauthenticator/blob/8499dc2/CHANGELOG.md#073---2018-02-16 · Vendor Advisory
• https://github.com/jupyterhub/oauthenticator/commit/1845c0e4b1bff3462c91c3108c85205acd3c75a2 · Patch
• https://osv.dev/vulnerability/CVE-2018-7206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7206 · Security Note
• https://osv.dev/vulnerability/PYSEC-2018-68 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8x3m-m3x9-54fj · Vendor Advisory
• https://github.com/jupyterhub/oauthenticator · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2018-151.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/oauthenticator/PYSEC-2018-68.yaml · Note
• https://github.com/advisories/GHSA-8x3m-m3x9-54fj · Note
• https://blog.jupyter.org/security-fix-for-jupyterhub-gitlab-oauthenticator-7b14571d1f76 · Note