GHSA-gprj-3p75-f996

Suggest an improvement
Source
https://github.com/advisories/GHSA-gprj-3p75-f996
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-gprj-3p75-f996/GHSA-gprj-3p75-f996.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-gprj-3p75-f996
Aliases
Related
Published
2024-06-12T17:13:07Z
Modified
2024-07-15T22:42:21.922673Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0
Details

Impact

JupyterHub < 5.0, when used with GlobusOAuthenticator, could be configured to allow all users from a particular institution only. The configuration for this would look like:

# Require users to be using the "foo.horse" identity provider, often an institution or university
c.GlobusAuthenticator.identity_provider = "foo.horse"
# Allow everyone who has that identity provider to log in
c.GlobusAuthenticator.allow_all = True

This worked fine prior to JupyterHub 5.0, because allow_all did not take precedence over identity_provider.

Since JupyterHub 5.0, allow_all does take precedence over identity_provider. On a hub with the same config, now all users will be allowed to login, regardless of identity_provider. identity_provider will basically be ignored.

This is a documented change in JupyterHub 5.0, but is likely to catch many users by surprise.

Patches

OAuthenticator 16.3.1 fixes the issue with JupyterHub 5.0, and does not affect previous versions.

Workarounds

Do not upgrade to JupyterHub 5.0 when using GlobusOAuthenticator in the prior configuration.

Database specific 
{
    "nvd_published_at": "2024-06-12T16:15:12Z",
    "cwe_ids": [
        "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-12T17:13:07Z"
}
References

Affected packages

PyPI / oauthenticator

Package

Name
oauthenticator
View open source insights on deps.dev
Purl
pkg:pypi/oauthenticator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
16.3.1

Affected versions

0.*

0.1.0
0.2.0
0.3.0
0.4.0
0.4.1
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.7.0
0.7.1
0.7.2
0.7.3
0.8.0
0.8.1
0.8.2
0.9.0
0.10.0
0.11.0
0.12.0
0.12.1
0.12.2
0.12.3
0.13.0

14.*

14.0.0
14.1.0
14.2.0

15.*

15.0.0
15.0.1
15.1.0

16.*

16.0.0
16.0.1
16.0.2
16.0.3
16.0.4
16.0.5
16.0.6
16.0.7
16.1.0
16.1.1
16.2.0
16.2.1
16.3.0