id: PYSEC-2022-206
details: OAuthenticator is an OAuth token library for the JupyerHub login handler.
  CILogonOAuthenticator is provided by the OAuthenticator package, and lets users
  log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub
  only to users of a given institute. The allowed_idps configuration trait of CILogonOAuthenticator
  is documented to be a list of domains that indicate the institutions whose users
  are authorized to access this JupyterHub. This authorization is validated by ensuring
  that the *email* field provided to us by CILogon has a *domain* that matches one
  of the domains listed in `allowed_idps`.If `allowed_idps` contains `berkeley.edu`,
  you might expect only users with valid current credentials provided by University
  of California, Berkeley to be able to access the JupyterHub. However, CILogonOAuthenticator
  does *not* verify which provider is used by the user to login, only the email address
  provided. So a user can login with a GitHub account that has email set to `<something>@berkeley.edu`,
  and that will be treated exactly the same as someone logging in using the UC Berkeley
  official Identity Provider. The patch fixing this issue makes a *breaking change*
  in how `allowed_idps` is interpreted. It's no longer a list of domains, but configuration
  representing the `EntityID` of the IdPs that are allowed, picked from the [list
  maintained by CILogon](https://cilogon.org/idplist/). Users are advised to upgrade.
affected:
- package:
    name: oauthenticator
    ecosystem: PyPI
    purl: pkg:pypi/oauthenticator
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 15.0.0
  versions:
  - 0.1.0
  - 0.10.0
  - 0.11.0
  - 0.12.0
  - 0.12.1
  - 0.12.2
  - 0.12.3
  - 0.13.0
  - 0.2.0
  - 0.3.0
  - 0.4.0
  - 0.4.1
  - 0.5.0
  - 0.5.1
  - 0.6.0
  - 0.6.1
  - 0.6.2
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.9.0
  - 14.0.0
  - 14.1.0
  - 14.2.0
references:
- type: ADVISORY
  url: https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-r7v4-jwx9-wx43
aliases:
- CVE-2022-31027
- GHSA-r7v4-jwx9-wx43
modified: "2022-06-16T05:33:11.901142Z"
published: "2022-06-09T13:15:00Z"