SCA: security update for oauthenticator (GHSA-55m3-44xf-hg4h)

critical Tenable Cloud Security Plugin ID 410593

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for
writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used
to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to
be to Google accounts part of one or more Google organization verified to control specified domain(s).
Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the
domain. Such accounts could have been created by anyone which at one time was able to read an email
associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th
December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can
login another way, such as `allowed_users` or `allowed_google_groups`. (CVE-2024-29033)

Plugin Details

Severity: Critical

ID: 410593

Version: Revision 1.12

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.37

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2024-29033

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/20/2024

Vulnerability Publication Date: 3/20/2024

Reference Information

CVE: CVE-2024-29033

cwe: CWE-285

Detections

Analytics