GHSA-p43p-whwx-q52h: Medium severity pip/jupyterhub vulnerability
Impact
Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.
Patches
Upgrade to 5.5.0.
Workarounds
Use an Authenticator that doesn't use a login form, such as OAuthenticator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/jupyterhubto a version that resolves this vulnerability.Fixed in 5.5.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.5.0 - Compensating control
Use an Authenticator that doesn't use a login form (e.g., OAuthenticator instead of the default PAM Authenticator) to avoid unbounded logging output when invalid input is provided to login.
Event History
Frequently Asked Questions
Which JupyterHub deployments are affected?
Deployments using a form-based Authenticator are affected, including the default PAM Authenticator. Deployments using OAuthenticator are not affected.
What does an attacker need to exploit this issue?
An attacker can trigger the issue by submitting invalid input to the login form. The supplied severity vector indicates that no privileges or user interaction are required and the attack can be performed over the network.
Is the default configuration affected?
Yes. The default PAM Authenticator is a form-based Authenticator and is affected.
What can be done if upgrading is not immediately possible?
Use an Authenticator that does not use a login form, such as OAuthenticator. The available patch is to upgrade JupyterHub to version 5.5.0.