CVE-2023-25574criticalCWE-347

CVE-2023-25574: falha crítica em jupyterhub ltiauthenticator

JupyterHub's LTI13Authenticator: JWT signature not validated

Publicada em

Seguir esta CVE+ Monitorar ltiauthenticator+ Monitorar jupyterhub-ltiauthenticator

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 10epss 0.4%
`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request. Only users that has configured a JupyterHub installation to use the authenticator class `LTI13Authenticator` are affected. `jupyterhub-ltiauthenticator` version 1.4.0 removes LTI13Authenticator to address the issue. No known workarounds are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
jupyterhub · ltiauthenticator
CVEs relacionadas — jupyterhub ltiauthenticator

No mesmo produto, das mais perigosas para as menos.

CVE-2026-34052MEDIUMLTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)EPSS 0.3%