CVE-2018-7206
High
Description
An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. (Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab_group_whitelist is unaffected. No other Authenticators are affected.)
SeverityHigh
CVSS8.8
Exploit probability—
ProductJupyter Oauthenticator
PublishedFeb 18, 2018
First seenFeb 18, 2018
How to fix
Update
- oauthenticator0.6.2, 0.7.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jupyter oauthenticator | 0.6.0, 0.6.1, 0.7.0, 0.7.1, 0.7.2 | — |
| oauthenticatorPyPI | 0.6 ≤ v < 0.6.2, 0.7 ≤ v < 0.7.3 | 0.6.2, 0.7.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.