CVE-2024-29033

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-29033", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-14T16:59:47.613Z", "datePublished": "2024-03-20T20:36:13.595Z", "dateUpdated": "2024-08-02T01:03:51.648Z"}, "containers": {"cna": {"title": "GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h"}, {"name": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60", "tags": ["x_refsource_MISC"], "url": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60"}, {"name": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of", "tags": ["x_refsource_MISC"], "url": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of"}], "affected": [{"vendor": "jupyterhub", "product": "oauthenticator", "versions": [{"version": "< 16.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-20T20:36:13.595Z"}, "descriptions": [{"lang": "en", "value": "OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`."}], "source": {"advisory": "GHSA-55m3-44xf-hg4h", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-29033", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-21T16:20:15.047713Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:58:08.797Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:03:51.648Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h"}, {"name": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60"}, {"name": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of"}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-29033", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-14T16:59:47.613Z", "datePublished": "2024-03-20T20:36:13.595Z", "dateUpdated": "2024-06-04T17:58:08.797Z"}, "containers": {"cna": {"title": "GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h"}, {"name": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60", "tags": ["x_refsource_MISC"], "url": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60"}, {"name": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of", "tags": ["x_refsource_MISC"], "url": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of"}], "affected": [{"vendor": "jupyterhub", "product": "oauthenticator", "versions": [{"version": "< 16.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-20T20:36:13.595Z"}, "descriptions": [{"lang": "en", "value": "OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`."}], "source": {"advisory": "GHSA-55m3-44xf-hg4h", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-29033", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-21T16:20:15.047713Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:19.160Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"product": "oauthenticator", "vendor": "jupyterhub", "versions": [{"status": "affected", "version": "< 16.3.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jupyter:oauthenticator:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7209D57-DAC0-4AC0-9B38-897ED442A6F2", "versionEndExcluding": "16.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`."}, {"lang": "es", "value": "OAuthenticator proporciona complementos para que JupyterHub utilice proveedores de OAuth comunes, as\u00ed como clases base para escribir sus propios autenticadores con cualquier proveedor de OAuth 2.0. `GoogleOAuthenticator.hosted_domain` se utiliza para restringir a qu\u00e9 cuentas de Google se les puede autorizar el acceso a un JupyterHub. La restricci\u00f3n est\u00e1 destinada a las cuentas de Google que forman parte de una o m\u00e1s organizaciones de Google verificadas para controlar dominios espec\u00edficos. Antes de la versi\u00f3n 16.3.0, la restricci\u00f3n real era para las cuentas de Google con correos electr\u00f3nicos que terminaban con el dominio. Estas cuentas podr\u00edan haber sido creadas por cualquier persona que en alg\u00fan momento haya podido leer un correo electr\u00f3nico asociado con el dominio. Esto fue descrito por Dylan Ayrey (@dxa4481) en esta [publicaci\u00f3n de blog] del 15 de diciembre de 2023). OAuthenticator 16.3.0 contiene un parche para este problema. Como workaround, restrinja qui\u00e9n puede iniciar sesi\u00f3n de otra manera, como \"usuarios_permitidos\" o \"grupos_de_google_permitidos\"."}], "id": "CVE-2024-29033", "lastModified": "2026-06-17T07:22:17.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-29033", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-03-21T16:20:15.047713Z", "version": "2.0.3"}}]}, "published": "2024-03-20T21:15:31.593", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h"}, {"source": "security-advisories@github.com", "tags": ["Press/Media Coverage", "Technical Description", "Third Party Advisory"], "url": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Press/Media Coverage", "Technical Description", "Third Party Advisory"], "url": "https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}