search

floryn90 / docker-hugo

Truly minimal Docker images for Hugo open-source static site generator.
https://hub.docker.com/r/floryn90/hugo
MIT License
31 stars 1 forks source link

upgraded various dependencies #126

Closed floryn90 closed 5 days ago

floryn90 commented 6 days ago

Upgraded dependencies:

github-actions[bot] commented 5 days ago

:mag: Vulnerabilities of floryn90/hugo:ext-ubuntu-ci

:package: Image Reference floryn90/hugo:ext-ubuntu-ci
digestsha256:d177acd5966cbc60c7c48ccae0b385c3c40421641243ab719186dc6d33493984
vulnerabilitiescritical: 1 high: 1 medium: 0 low: 0
size319 MB
packages838
:package: Base Image ubuntu:24.04
also known as
  • latest
  • noble
  • noble-20240605
  • rolling
digestsha256:c920ba4cfca05503764b785c16b76d43c83a6df8d1ab107e7e6610000d94315c
vulnerabilitiescritical: 0 high: 0 medium: 2 low: 6
critical: 1 high: 0 medium: 0 low: 0 stdlib 1.22.2 (golang) pkg:golang/stdlib@1.22.2
critical : CVE--2024--24790
Affected range>=1.22.0-0
<1.22.4
Fixed version1.22.4
EPSS Score0.06%
EPSS Percentile27th percentile
Description
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
critical: 0 high: 1 medium: 0 low: 0 rdoc 6.5.0 (gem) pkg:gem/rdoc@6.5.0
high : CVE--2024--27281 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected range>=6.5.0
<6.5.1.1
Fixed version6.5.1.1
Description
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing `.rdoc_options` (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored. When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache. We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: * For Ruby 3.0 users: Update to `rdoc` 6.3.4.1 * For Ruby 3.1 users: Update to `rdoc` 6.4.1.1 * For Ruby 3.2 users: Update to `rdoc` 6.5.1.1 You can use `gem update rdoc` to update it. If you are using bundler, please add `gem "rdoc", ">= 6.6.3.1"` to your `Gemfile`. Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.