CVE-2018-7206: JupyterHub OAuthenticator elevation of privilege
(updated )
An issue was discovered in Project Jupyter JupyterHub OAuthenticator. When using JupyterHub with a GitLab allowlist for access control, group membership is not checked correctly, allowing members that are not in the allowlist to create accounts on the Hub.
References
- blog.jupyter.org/security-fix-for-jupyterhub-gitlab-oauthenticator-7b14571d1f76
- github.com/advisories/GHSA-8x3m-m3x9-54fj
- github.com/jupyterhub/oauthenticator
- github.com/jupyterhub/oauthenticator/blob/8499dc2/CHANGELOG.md
- github.com/jupyterhub/oauthenticator/commit/1845c0e4b1bff3462c91c3108c85205acd3c75a2
- github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2018-151.yaml
- github.com/pypa/advisory-database/tree/main/vulns/oauthenticator/PYSEC-2018-68.yaml
- nvd.nist.gov/vuln/detail/CVE-2018-7206
Code Behaviors & Features
Detect and mitigate CVE-2018-7206 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →