Yuvipanda

**Name of the Vulnerable Software and Affected Versions** Jupyter Server Proxy versions prior to 3.2.3 Jupyter Server Proxy versions prior to 4.1.1 **Description** The issue is related to the lack of proper user authentication when proxying websockets in Jupyter Server Proxy. This allows unauthenticated access to anyone with network access to the Jupyter server endpoint, potentially leading to remote unauthenticated arbitrary code execution. The vulnerability affects projects that rely on websockets, but not those that do not use websockets or the websocket endpoints exposed by `jupyter server` itself. **Recommendations** For Jupyter Server Proxy versions prior to 3.2.3, upgrade to version 3.2.3 or later. For Jupyter Server Proxy versions prior to 4.1.1, upgrade to version 4.1.1 or later. As a temporary workaround, consider restricting access to the vulnerable websocket endpoints until a patch is applied. For JupyterHub admins, follow the provided steps to check for and patch the vulnerability in user servers, and consider terminating currently running user servers that may still be vulnerable.

**Name of the Vulnerable Software and Affected Versions** CILogonOAuthenticator versions prior to 15.0.0 **Description** The issue concerns the authorization mechanism in CILogonOAuthenticator, which is used to restrict access to a JupyterHub based on the user's institution. The `allowed idps` configuration trait is intended to list the domains of authorized institutions, but it only verifies the email address provided by CILogon, not the identity provider used. This means a user can access the JupyterHub with a GitHub account that has an email address matching the authorized domain, even if their access to the institution's identity provider has been revoked. The patch for this issue changes how `allowed idps` is interpreted, now requiring the `EntityID` of allowed identity providers. **Recommendations** For versions prior to 15.0.0, upgrade to version 15.0.0 or above and update the `allowed idps` configuration to use the `EntityID` of the allowed identity providers, as specified in the migration documentation. As a temporary workaround, consider restricting access to the JupyterHub until the patch can be applied.