DeepikaKaranji / ContainerApplication-Security-With-JenkinsCI

Project for securing development life cycle of Containerized Applications
0 stars 0 forks source link

CVE-2021-32862 (Medium) detected in nbconvert-5.6.1-py2.py3-none-any.whl #23

Open mend-bolt-for-github[bot] opened 2 years ago

mend-bolt-for-github[bot] commented 2 years ago

CVE-2021-32862 - Medium Severity Vulnerability

Vulnerable Library - nbconvert-5.6.1-py2.py3-none-any.whl

Converting Jupyter Notebooks (.ipynb files) to other formats. Output formats include asciidoc, html, latex, markdown, pdf, py, rst, script. nbconvert can be used both as a Python library (`import nbconvert`) or as a command line tool (invoked as `jupyter nbconvert ...`).

Library home page: https://files.pythonhosted.org/packages/79/6c/05a569e9f703d18aacb89b7ad6075b404e8a4afde2c26b73ca77bb644b14/nbconvert-5.6.1-py2.py3-none-any.whl

Path to dependency file: /tmp/ws-scm/Container-Security-With-JenkinsCI/requirements.txt

Path to vulnerable library: /tmp/ws-scm/Container-Security-With-JenkinsCI/requirements.txt

Dependency Hierarchy: - notebook-5.4.0-py2.py3-none-any.whl (Root Library) - :x: **nbconvert-5.6.1-py2.py3-none-any.whl** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

Publish Date: 2022-08-18

URL: CVE-2021-32862

CVSS 3 Score Details (5.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-9jmq-rx5f-8jwq

Release Date: 2022-08-18

Fix Resolution (nbconvert): 6.3.0

Direct dependency fix Resolution (notebook): 5.4.1


Step up your Open Source Security Game with Mend here