id: PYSEC-2021-384
details: FirstUseAuthenticator is a JupyterHub authenticator that helps new users
  set their password on their first login to JupyterHub. When JupyterHub is used with
  FirstUseAuthenticator, a vulnerability in versions prior to 1.0.0 allows unauthorized
  access to any user's account if `create_users=True` and the username is known or
  guessed. One may upgrade to version 1.0.0 or apply a patch manually to mitigate
  the vulnerability. For those who cannot upgrade, there is no complete workaround,
  but a partial mitigation exists. One can disable user creation with `c.FirstUseAuthenticator.create_users
  = False`, which will only allow login with fully normalized usernames for already
  existing users prior to jupyterhub-firstuserauthenticator 1.0.0. If any users have
  never logged in with their normalized username (i.e. lowercase), they will still
  be vulnerable until a patch or upgrade occurs.
affected:
- package:
    name: jupyterhub-firstuseauthenticator
    ecosystem: PyPI
    purl: pkg:pypi/jupyterhub-firstuseauthenticator
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.0.0
  versions:
  - "0.10"
  - "0.11"
  - "0.12"
  - 0.13.0
  - 0.14.0
  - 0.14.1
  - "0.9"
references:
- type: WEB
  url: https://github.com/jupyterhub/firstuseauthenticator/pull/38.patch
- type: ADVISORY
  url: https://github.com/jupyterhub/firstuseauthenticator/security/advisories/GHSA-5xvc-vgmp-jgc3
- type: WEB
  url: https://github.com/jupyterhub/firstuseauthenticator/pull/38
aliases:
- CVE-2021-41194
- GHSA-5xvc-vgmp-jgc3
modified: "2021-11-03T14:26:52.434933Z"
published: "2021-10-28T20:15:00Z"