CVE-2024-37300highCWE-863

CVE-2024-37300: falha de alta gravidade em jupyterhub oauthenticator

Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar oauthenticator+ Monitorar oauthenticator

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.4%
OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub < 5.0, when used with `GlobusOAuthenticator`, could be configured to allow all users from a particular institution only. This worked fine prior to JupyterHub 5.0, because `allow_all` did not take precedence over `identity_provider`. Since JupyterHub 5.0, `allow_all` does take precedence over `identity_provider`. On a hub with the same config, now all users will be allowed to login, regardless of `identity_provider`. `identity_provider` will basically be ignored. This is a documented change in JupyterHub 5.0, but is likely to catch many users by surprise. OAuthenticator 16.3.1 fixes the issue with JupyterHub 5.0, and does not affect previous versions. As a workaround, do not upgrade to JupyterHub 5.0 when using `GlobusOAuthenticator` in the prior configuration.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
jupyterhub · oauthenticator
CVEs relacionadas — jupyterhub oauthenticator

No mesmo produto, das mais perigosas para as menos.

CVE-2020-26250MEDIUMBase class whitelist configuration ignored in OAuthenticatorEPSS 1.1%CVE-2024-29033HIGHGoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspaceEPSS 0.6%CVE-2022-31027MEDIUMAuthorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticatorEPSS 0.5%CVE-2026-33175HIGHOAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email ClaimsEPSS 0.4%