CVE-2018-7206

描述

An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. (Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab_group_whitelist is unaffected. No other Authenticators are affected.)

如何修補 CVE-2018-7206

要修補 CVE-2018-7206,請將受影響套件升級到下列已修補版本。

• —升級至 0.6.2 或更新版本
• —升級至 1845c0e4b1bff3462c91c3108c85205acd3c75a2 或更新版本

CVE-2018-7206 正在被利用嗎?

低 — EPSS 為 1.8%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• >= 0.6, < 0.6.2
• from 0, < 1845c0e4b1bff3462c91c3108c85205acd3c75a2 | >= 0.6, < 0.6.2, >= 0.7, < 0.7.3

CVSS 分數

參考連結(8)

• ADVISORYgithub.com/advisories/GHSA-8x3m-m3x9-54fj
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-7206
• PATCHgithub.com/jupyterhub/oauthenticator
• WEBblog.jupyter.org/security-fix-for-jupyterhub-gitlab-oauthenticator-7b14571d1f76