Detections
Analytics

SCA: security update for oauthenticator (GHSA-384w-5v3f-q499)

high Tenable Self-Hosted Container Security Plugin ID 409386

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and
 before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be
 transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by OAuthenticator
 classes, resulting in the same behavior as if this configuration has not been set. If this is the only
 mechanism of authorization restriction (i.e. no group or team restrictions in configuration) then all
 authenticated users will be allowed. Provider-based restrictions, including deprecated values such as
 `GitHubOAuthenticator.org_whitelist` are **not** affected. All users of OAuthenticator 0.12.0 and 0.12.1
 with JupyterHub 1.2 (JupyterHub Helm chart 0.10.0-0.10.5) who use the `admin.whitelist.users`
 configuration in the jupyterhub helm chart or the `c.Authenticator.whitelist` configuration directly.
 Users of other deprecated configuration, e.g. `c.GitHubOAuthenticator.team_whitelist` are **not**
 affected. If you see a log line like this and expect a specific list of allowed usernames: "[I 2020-11-27
 16:51:54.528 JupyterHub app:1717] Not using allowed_users. Any authenticated user will be allowed." you
 are likely affected. Updating oauthenticator to 0.12.2 is recommended. A workaround is to replace the
 deprecated `c.Authenticator.whitelist = ...` with `c.Authenticator.allowed_users = ...`. If any users have
 been authorized during this time who should not have been, they must be deleted via the API or admin
 interface, per the referenced documentation. (CVE-2020-26250)

See Also

https://github.com/advisories/GHSA-384w-5v3f-q499

Plugin Details

Severity: High

ID: 409386

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 50.87

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2020-26250

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.3

Threat Score: 5.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/1/2020

Vulnerability Publication Date: 12/1/2020

Reference Information

CVE: CVE-2020-26250

cwe: CWE-863