CVE-2018-7206: High severity jupyter OAuthenticator vulnerability
An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. (Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlabgroupwhitelist is unaffected. No other Authenticators are affected.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/oauthenticatorto a version that resolves this vulnerability.Fixed in 0.7.3 - Upgrade
Upgrade
pip/oauthenticatorto a version that resolves this vulnerability.Fixed in 0.6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7206?
The severity of CVE-2018-7206 is high, with a severity score of 8.8.
How does CVE-2018-7206 affect JupyterHub OAuthenticator?
CVE-2018-7206 affects JupyterHub OAuthenticator versions 0.6.x before 0.6.2 and 0.7.x before 0.7.3.
What is the impact of CVE-2018-7206?
CVE-2018-7206 allows members not in the whitelisted groups to create accounts on JupyterHub when using GitLab group whitelisting for access control.
How do I fix CVE-2018-7206?
To fix CVE-2018-7206, update JupyterHub OAuthenticator to version 0.6.2 or 0.7.3, depending on the affected version.
Where can I find more information about CVE-2018-7206?
You can find more information about CVE-2018-7206 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-7206), [GitHub](https://github.com/jupyterhub/oauthenticator/commit/1845c0e4b1bff3462c91c3108c85205acd3c75a2), [Jupyter Blog](https://blog.jupyter.org/security-fix-for-jupyterhub-gitlab-oauthenticator-7b14571d1f76).