143 matches found
OAuthenticator security vulnerability
OAuthenticator is an OAuth token library for the JupyerHub login handler. A security vulnerability exists in OAuthenticator version 14.2.0 and earlier, which stems from CILogon, a federated authentication provider that allows users to authenticate with multiple identity providers IdPs...
Authorization Bypass
oauthenticator is vulnerable to authorization bypass. The vulnerability exists because CILogonOAuthenticator doesn't properly validate the email address which allows an attacker to get access to the JupyterHub...
GHSA-R7V4-JWX9-WX43 Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator
Background CILogon is a federated auth provider that allows users to authenticate themselves via a number of Identity Providers IdP, focused primarily on educational and research institutions such as Universities. More traditional and open IdPs such as GitHub, ORCID, Google, Microsoft, etc are al...
Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator
Background CILogon is a federated auth provider that allows users to authenticate themselves via a number of Identity Providers IdP, focused primarily on educational and research institutions such as Universities. More traditional and open IdPs such as GitHub, ORCID, Google, Microsoft, etc are al...
jupyterhubutils (>=0.11.0, <=0.25.0), jupyterlabutils (>=0.9.1, <=0.10.0) +2 more potentially affected by CVE-2022-31027 via oauthenticator (0.13.0)
oauthenticator PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - jupyterhubutils =0.11.0, =0.9.1, =0.30.1, =0.0.2, =0.4.2 Source cves: CVE-2022-31027 Source advisory: OSV:GHSA-R7V4-JWX9-WX43...
keycloakauthenticator (>=3.0.0, <=3.1.0) potentially affected by CVE-2022-31027 via oauthenticator (14.2.0)
oauthenticator PYPI version 14.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =3.0.0, =3.1.0 Source cves: CVE-2022-31027 Source advisory: OSV:GHSA-R7V4-JWX9-WX43...
ssb-ipython-kernels (>=0.2.25, <=0.3.2) potentially affected by CVE-2022-31027 via oauthenticator (14.0.0)
oauthenticator PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - ssb-ipython-kernels =0.2.25, =0.3.2 Source cves: CVE-2022-31027 Source advisory: OSV:GHSA-R7V4-JWX9-WX43...
CVE-2022-31027 Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator
OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...
CVE-2022-31027
CVE-2022-31027 affects the OAuthenticator/CILogonOAuthenticator used by JupyterHub. The root cause is that allowed_idps is validated only by email domain, not by IdP (provider) identity, allowing login via an alternate IdP with a @domained email (e.g., berkeley.edu) to bypass intended restriction...
CVE-2022-31027
OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...
jupyterhubutils (>=0.11.0, <=0.25.0), jupyterlabutils (>=0.9.1, <=0.10.0) +4 more potentially affected by CVE-2022-31027 via oauthenticator (>=0.13.0, <=14.2.0)
oauthenticator PYPI version =0.13.0, =0.11.0, =0.9.1, =3.0.0, =0.30.1, =0.2.25, =0.0.2, =0.4.2 Source cves: CVE-2022-31027 Source advisory: MEND:CVE-2022-31027...
CVE-2022-31027 Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator
OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...
CVE-2022-31027: Authorization Bypass Through User-Controlled Key
OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...
GHSA-8X3M-M3X9-54FJ JupyterHub OAuthenticator elevation of privilege
An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on...
JupyterHub OAuthenticator elevation of privilege
An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on...
Insecure Access Control
oauthenticator uses insecure access control. The deprecated configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by OAuthenticator classes, resulting in the same behavior as if this configuration has not been...
CVE-2020-26250
OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated in jupyterhub 1.2 configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by...
CVE-2020-26250
OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated in jupyterhub 1.2 configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by...
PYSEC-2020-68
OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated in jupyterhub 1.2 configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by...
Design/Logic Flaw
OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated in jupyterhub 1.2 configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by...