search

snowdensb / dependabot-core

🤖 The core logic behind Dependabot's update PR creation, and the public issue tracker for all things Dependabot
https://github.com/features/security
Other
0 stars 0 forks source link

CVE-2021-32862 (Medium) detected in nbconvert-5.6.1-py2.py3-none-any.whl - autoclosed #745

Closed mend-for-github-com[bot] closed 6 months ago

mend-for-github-com[bot] commented 2 years ago

CVE-2021-32862 - Medium Severity Vulnerability

Vulnerable Library - nbconvert-5.6.1-py2.py3-none-any.whl

Converting Jupyter Notebooks

Library home page: https://files.pythonhosted.org/packages/79/6c/05a569e9f703d18aacb89b7ad6075b404e8a4afde2c26b73ca77bb644b14/nbconvert-5.6.1-py2.py3-none-any.whl

Path to dependency file: /python/spec/fixtures/projects/unresolvable/requirements.txt

Path to vulnerable library: /python/spec/fixtures/projects/unresolvable/requirements.txt,/python/spec/fixtures/projects/unresolvable/requirements.txt

Dependency Hierarchy: - :x: **nbconvert-5.6.1-py2.py3-none-any.whl** (Vulnerable Library)

Found in HEAD commit: ba8cd9078c8ce0cb202767d627706711237abf71

Found in base branch: main

Vulnerability Details

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

Publish Date: 2022-08-18

URL: CVE-2021-32862

CVSS 3 Score Details (5.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-9jmq-rx5f-8jwq

Release Date: 2022-08-18

Fix Resolution: 6.3.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

mend-for-github-com[bot] commented 6 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.