CVE-2023-25574

CRITICAL Year: 2023
CVSS v3 Score
10.0
Critical
Weakness Type
CWE-347
View all →

Vulnerability Description

`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request. Only users that has configured a JupyterHub installation to use the authenticator class `LTI13Authenticator` are affected. `jupyterhub-ltiauthenticator` version 1.4.0 removes LTI13Authenticator to address the issue. No known workarounds are available.

Related Vulnerabilities

CVE-2020-2021

CRITICAL
CVSS:10.0(Critical)

When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS ...

CWE-3472020

CVE-2024-32962

CRITICAL
CVSS:10.0(Critical)

xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the...

CWE-3472024

CVE-2022-26510

CRITICAL
CVSS:9.9(Critical)

A firmware update vulnerability exists in the iburn firmware checks functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted HTTP request can lead to firmware update. An attacker can ...

CWE-3472022

CVE-2014-3585

CRITICAL
CVSS:9.8(Critical)

redhat-upgrade-tool: Does not check GPG signatures when upgrading versions

CWE-3472014

CVE-2016-20021

CRITICAL
CVSS:9.8(Critical)

In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-we...

CWE-3472016

CVE-2017-18146

CRITICAL
CVSS:9.8(Critical)

In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12...

CWE-3472017