tlkh/serverless-transformers

CVE-2021-32862 (Medium) detected in nbconvert-5.6.1-py2.py3-none-any.whl

Opened this issue · 0 comments

mend-bolt-for-github commented

CVE-2021-32862 - Medium Severity Vulnerability

Vulnerable Library - nbconvert-5.6.1-py2.py3-none-any.whl

Converting Jupyter Notebooks (.ipynb files) to other formats. Output formats include asciidoc, html, latex, markdown, pdf, py, rst, script. nbconvert can be used both as a Python library (`import nbconvert`) or as a command line tool (invoked as `jupyter nbconvert ...`).

Library home page: https://files.pythonhosted.org/packages/79/6c/05a569e9f703d18aacb89b7ad6075b404e8a4afde2c26b73ca77bb644b14/nbconvert-5.6.1-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt,/backend/requirements.txt

Dependency Hierarchy:

  • streamlit-0.55.2-py2.py3-none-any.whl (Root Library)
    • pydeck-0.5.0-py2.py3-none-any.whl
      • ipywidgets-7.5.1-py2.py3-none-any.whl
        • widgetsnbextension-3.5.1-py2.py3-none-any.whl
          • notebook-5.7.10-py2.py3-none-any.whl
            • ❌ nbconvert-5.6.1-py2.py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

Publish Date: 2022-08-18

URL: CVE-2021-32862

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9jmq-rx5f-8jwq

Release Date: 2022-08-18

Fix Resolution (nbconvert): 6.3.0

Direct dependency fix Resolution (streamlit): 0.56.0

Step up your Open Source Security Game with Mend here