CVE-2018-7206
First published: Sun Feb 18 2018(Updated: )
An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. (Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab_group_whitelist is unaffected. No other Authenticators are affected.)
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jupyter Oauthenticator | =0.6.0 | |
| Jupyter Oauthenticator | =0.6.1 | |
| Jupyter Oauthenticator | =0.7.0 | |
| Jupyter Oauthenticator | =0.7.1 | |
| Jupyter Oauthenticator | =0.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-7206?
The severity of CVE-2018-7206 is high, with a severity score of 8.8.
How does CVE-2018-7206 affect JupyterHub OAuthenticator?
CVE-2018-7206 affects JupyterHub OAuthenticator versions 0.6.x before 0.6.2 and 0.7.x before 0.7.3.
What is the impact of CVE-2018-7206?
CVE-2018-7206 allows members not in the whitelisted groups to create accounts on JupyterHub when using GitLab group whitelisting for access control.
How do I fix CVE-2018-7206?
To fix CVE-2018-7206, update JupyterHub OAuthenticator to version 0.6.2 or 0.7.3, depending on the affected version.
Where can I find more information about CVE-2018-7206?
You can find more information about CVE-2018-7206 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-7206), [GitHub](https://github.com/jupyterhub/oauthenticator/commit/1845c0e4b1bff3462c91c3108c85205acd3c75a2), [Jupyter Blog](https://blog.jupyter.org/security-fix-for-jupyterhub-gitlab-oauthenticator-7b14571d1f76).
- collector/github-advisory-latest
- alias/GHSA-8x3m-m3x9-54fj
- alias/CVE-2018-7206
- collector/github-advisory
- collector/nvd-index
- collector/nvd-cve
- agent/type
- agent/author
- agent/event
- agent/remedy
- agent/first-publish-date
- agent/tags
- agent/description
- agent/references
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- package-manager/pip
- vendor/jupyter
- canonical/jupyter oauthenticator
- version/jupyter oauthenticator/0.6.0
- version/jupyter oauthenticator/0.6.1
- version/jupyter oauthenticator/0.7.0
- version/jupyter oauthenticator/0.7.1
- version/jupyter oauthenticator/0.7.2