fabricauthenticator (>=0.0.2.5 <=1.3.4rc0), jupyterhub-ltiauthenticator (=1.3.0) +7 more potentially affected by CVE-2024-37300 via oauthenticator (>=14.0.0 <=16.2.1)

oauthenticator PYPI version =14.0.0, =0.0.2.5, =3.0.0, =1.0.2, =0.1.0, =1.1.9, =0.5.0, =0.2.25, =0.3.2 Source cves: CVE-2024-37300 Source advisory: OSV:GHSA-GPRJ-3P75-F996...

CVE-2024-37300 vulnerabilities

Vulnerabilities for packages: py3-oauthenticator...

CVE-2024-37300 vulnerabilities

Vulnerabilities for packages: py3-oauthenticator...

CVE-2024-37300 Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub 5.0, when used with GlobusOAuthenticator, could be configured to allow all users from a particular institution only. This worked fine prior to JupyterHub 5.0, because allowall di...

CVE-2024-37300

CVE-2024-37300 affects OAuthenticator used with JupyterHub when configured with Globe?osAuthenticator (GlobusOAuthenticator) prior to version 5.0. In JupyterHub 5.0, the setting allow_all takes precedence over identity_provider, which can cause all users from any institution to log in, effectivel...