Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-108752 →
DEBIAN-CVE-2026-108752
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
jupyterhub
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
jupyterhub
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
jupyterhub
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- advisory security-tracker.debian.org