Access Control Flaw in JupyterHub OAuthenticator from Project Jupyter

CVE-2018-7206

What is CVE-2018-7206?

A flaw was identified in the authentication mechanism of JupyterHub OAuthenticator where GitLab group whitelisting for access control was not implemented correctly. This issue permitted users who were not members of the designated groups to create their own accounts on the JupyterHub. While these unauthorized users could not access the accounts of others, they were able to register with their GitLab credentials, bypassing the intended restrictions. This vulnerability affects specific versions of the OAuthenticator when paired with GitLab, while other authentication methods remain secure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References