CVE-2024-29033

Advisory

OAuthenticator provides plugins for JupyterHub to use common OAuth providers and base classes for writing custom Authenticators with any OAuth 2.0 provider. The GoogleOAuthenticator.hosted_domain setting is intended to restrict access to JupyterHub to Google accounts within one or more verified Google organizations controlling specified domains. However, prior to the latest patch, the restriction was applied merely to Google accounts with email addresses ending in the specified domain. This meant that anyone who had ever been able to read an email associated with the domain could create such an account. This issue was highlighted by Dylan Ayrey in a blog post on December 15, 2023. A patch has been released to address this issue.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-55m3-44xf-hg4h
• https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29033