CVE-2024-29033

Summary

CVE-2024-29033: In earlier versions of OAuthenticator for JupyterHub, the GoogleOAuthenticator plugin had a flawed restriction mechanism for authorizing Google accounts. The intended restriction was to Google accounts associated with verified organizations controlling specific domains. However, prior to version 16.3.0, the actual restriction was based on email domain suffixes, allowing unauthorized access for accounts that had once been associated with the domain. This issue, disclosed by Dylan Ayrey, was addressed in version 16.3.0. As a temporary solution, administrators can restrict logins using alternative methods, such as `allowed_users` or `allowed_google_groups`.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.