Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-108752 →
UBUNTU-CVE-2026-108752
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:22.04:LTS
jupyterhub
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:24.04:LTS
jupyterhub
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.10
jupyterhub
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Ubuntu:26.04:LTS
jupyterhub
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Références
- report ubuntu.com
- report cve.org
- report github.com
- report github.com
- report github.com
- report github.com
- report hackmd.io
- report vulncheck.com