id: PYSEC-2018-68
details: An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x
  before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting
  for access control, group membership was not checked correctly, allowing members
  not in the whitelisted groups to create accounts on the Hub. (Users were not allowed
  to access other users' accounts, but could create their own accounts on the Hub
  linked to their GitLab account. GitLab authentication not using gitlab_group_whitelist
  is unaffected. No other Authenticators are affected.)
affected:
- package:
    name: oauthenticator
    ecosystem: PyPI
    purl: pkg:pypi/oauthenticator
  ranges:
  - type: GIT
    repo: https://github.com/jupyterhub/oauthenticator
    events:
    - introduced: "0"
    - fixed: 1845c0e4b1bff3462c91c3108c85205acd3c75a2
  - type: ECOSYSTEM
    events:
    - introduced: "0.6"
    - fixed: 0.6.2
    - introduced: "0.7"
    - fixed: 0.7.3
  versions:
  - 0.6.0
  - 0.6.1
  - 0.7.0
  - 0.7.1
  - 0.7.2
references:
- type: ARTICLE
  url: https://blog.jupyter.org/security-fix-for-jupyterhub-gitlab-oauthenticator-7b14571d1f76
- type: FIX
  url: https://github.com/jupyterhub/oauthenticator/commit/1845c0e4b1bff3462c91c3108c85205acd3c75a2
- type: WEB
  url: https://github.com/jupyterhub/oauthenticator/blob/8499dc2/CHANGELOG.md#073---2018-02-16
- type: ADVISORY
  url: https://github.com/advisories/GHSA-8x3m-m3x9-54fj
aliases:
- CVE-2018-7206
- GHSA-8x3m-m3x9-54fj
modified: "2021-08-25T04:30:14.910557Z"
published: "2018-02-18T03:29:00Z"