JupyterHub LTI Authenticator Unbounded Memory Growth Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in the JupyterHub LTI Authenticator, specifically in versions through 1.6.2. The issue arises because the LTI 1.1 validator improperly manages OAuth nonces, storing them in a class-level dictionary that can grow indefinitely. Nonces are added before validating signatures, allowing an attacker with a valid consumer key to send multiple requests with unique nonces. This behavior can gradually deplete server memory, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability leads to unbounded memory consumption on the server, causing a denial-of-service condition where the server becomes unresponsive or unavailable.

Remediation

Users can upgrade to JupyterHub LTI Authenticator version 1.6.3 to address this vulnerability.