PyPI/oauthenticator CVE-2020-26250: medium 6.3, EPSS 1.13%
OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which sh
Action: Upgrade oauthenticator to 0.12.2 or later.
pip install oauthenticator==0.12.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.12.0 | 0.12.2 | - |
Fixed versions
| 0.12.2 |
Sources
- osv: PYSEC-2020-68
- nvd: CVE-2020-26250
- https://github.com/jupyterhub/oauthenticator/blob/master/docs/source/changelog.md#0122---2020-11-30
- https://github.com/jupyterhub/oauthenticator/commit/a4aac191c16cf6281f3d346615aefa75702b02d7
- https://jupyterhub.readthedocs.io/en/1.2.2/getting-started/authenticators-users-basics.html#add-or-remove-users-from-the-hub
- https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-384w-5v3f-q499
CVE-2020-26250 · published · modified · JSON