CVE-2020-26250
2 advisories.
PyPI/oauthenticator CVE-2020-26250: medium 6.3
Base class whitelist configuration ignored in OAuthenticator
Action: Upgrade oauthenticator to 0.12.2 or later.
pip install oauthenticator==0.12.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.12.0 | 0.12.2 | - |
Fixed versions
| 0.12.2 |
Sources
- osv: GHSA-384w-5v3f-q499
- https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-384w-5v3f-q499
- https://nvd.nist.gov/vuln/detail/CVE-2020-26250
- https://github.com/jupyterhub/oauthenticator/commit/a4aac191c16cf6281f3d346615aefa75702b02d7
- https://github.com/jupyterhub/oauthenticator
- https://github.com/jupyterhub/oauthenticator/blob/master/docs/source/changelog.md#0122---2020-11-30
- https://github.com/pypa/advisory-database/tree/main/vulns/oauthenticator/PYSEC-2020-68.yaml
- https://jupyterhub.readthedocs.io/en/1.2.2/getting-started/authenticators-users-basics.html#add-or-remove-users-from-the-hub
CVE-2020-26250 · published · modified · JSON
PyPI/oauthenticator CVE-2020-26250: unknown
OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which sh
Action: Upgrade oauthenticator to 0.12.2 or later.
pip install oauthenticator==0.12.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.12.0 | 0.12.2 | - |
Fixed versions
| 0.12.2 |
Sources
- osv: PYSEC-2020-68
- https://github.com/jupyterhub/oauthenticator/blob/master/docs/source/changelog.md#0122---2020-11-30
- https://github.com/jupyterhub/oauthenticator/commit/a4aac191c16cf6281f3d346615aefa75702b02d7
- https://jupyterhub.readthedocs.io/en/1.2.2/getting-started/authenticators-users-basics.html#add-or-remove-users-from-the-hub
- https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-384w-5v3f-q499
CVE-2020-26250 · published · modified · JSON