Debian 10: DLA-3442-1 Moderate: Nbconvert XSS Risks Mitigated

debian lts

June 3, 2023

Alvaro MuÃ±oz from the GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert, a tool and library used to convert notebooks to v...

Topics Covered

security advisory update debian security fix moderate severity xss issue nbconvert

Summary

* GHSL-2021-1013: XSS in notebook.metadata.language_info.pygments_lexer;
* GHSL-2021-1014: XSS in notebook.metadata.title;
* GHSL-2021-1015: XSS in notebook.metadata.widgets;
* GHSL-2021-1016: XSS in notebook.cell.metadata.tags;
* GHSL-2021-1017: XSS in output data text/html cells;
* GHSL-2021-1018: XSS in output data image/svg+xml cells;
* GHSL-2021-1019: XSS in notebook.cell.output.svg_filename;
* GHSL-2021-1020: XSS in output data text/markdown cells;
* GHSL-2021-1021: XSS in output data application/javascript cells;
* GHSL-2021-1022: XSS in output.metadata.filenames image/png and
image/jpeg;
* GHSL-2021-1023: XSS in output data image/png and image/jpeg cells;
* GHSL-2021-1024: XSS in output.metadata.width/height image/png and
image/jpeg;
* GHSL-2021-1025: XSS in output data application/vnd.jupyter.widget-state+
json cells;
* GHSL-2021-1026: XSS in output data application/vnd.jupyter.widget-view+
json cells;
* GHSL-2021-1027: XSS in raw cells; and