-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 03 Jun 2023 03:59:58 +0200 Source: nbconvert Architecture: source Version: 5.4-2+deb10u1 Distribution: buster-security Urgency: high Maintainer: Debian Python Modules Team <python-modules-team@lists.alioth.debian.org> Changed-By: Guilhem Moulin <guilhem@debian.org> Changes: nbconvert (5.4-2+deb10u1) buster-security; urgency=high . * Non-maintainer upload by the LTS Security Team. * CVE-2021-32862: When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server without tight Content-Security-Policy (e.g., nbviewer): + GHSL-2021-1013: XSS in notebook.metadata.language_info.pygments_lexer. + GHSL-2021-1014: XSS in notebook.metadata.title. + GHSL-2021-1015: XSS in notebook.metadata.widgets. + GHSL-2021-1016: XSS in notebook.cell.metadata.tags. + GHSL-2021-1017: XSS in output data text/html cells. + GHSL-2021-1018: XSS in output data image/svg+xml cells. + GHSL-2021-1019: XSS in notebook.cell.output.svg_filename. + GHSL-2021-1020: XSS in output data text/markdown cells. + GHSL-2021-1021: XSS in output data application/javascript cells. + GHSL-2021-1022: XSS in output.metadata.filenames image/png and image/jpeg. + GHSL-2021-1023: XSS in output data image/png and image/jpeg cells. + GHSL-2021-1024: XSS is output.metadata.width/height image/png and image/jpeg. + GHSL-2021-1025: XSS in output data application/vnd.jupyter.widget- state+json cells. + GHSL-2021-1026: XSS in output data application/vnd.jupyter.widget- view+json cells. + GHSL-2021-1027: XSS in raw cells. + GHSL-2021-1028: XSS in markdown cells. * Some of these vulnerabilities, namely GHSL-2021-1017, -1020, -1021, and -1028, are actually design decisions where text/html, text/markdown, application/JavaScript and markdown cells should allow for arbitrary JavaScript code execution. These vulnerabilities are therefore left open by default, but users can opt-out and strip down all JavaScript elements via a new HTMLExporter option `sanitize_html`. * Convert input to string prior to escape HTML. * DEP-8: Run the upstream test suite (for python 2 & 3) to test the above. Checksums-Sha1: aa551ff5f885b3de73372bb8e30ae0f1bfae1278 3365 nbconvert_5.4-2+deb10u1.dsc 8a51d4d15a6dc1a09cd559a849c72819f5e2e745 501336 nbconvert_5.4.orig.tar.gz 563ed6cd4b5f50775dfd0fa6c03d5eaf3f4b7daa 15844 nbconvert_5.4-2+deb10u1.debian.tar.xz 3c51edb96adf8490409ae77d5d97c057db710569 17781 nbconvert_5.4-2+deb10u1_amd64.buildinfo Checksums-Sha256: 49d0d233d90aa6e4793f357d635d7d6df5e39a508dcf02ffa7c960e7c1dfd0cb 3365 nbconvert_5.4-2+deb10u1.dsc 7fc506624b9715a607abc7cc189b9d70fe73a483974a42a389f8188d1a8e3d0c 501336 nbconvert_5.4.orig.tar.gz 3a6a27ef4c42d9babd01f5e71011a6a52c3226d64a19b1a424f301bfba27a7e8 15844 nbconvert_5.4-2+deb10u1.debian.tar.xz 3bef1aa8824b43c06e85a96d0333c63c89201a9f56a49cdaf52dfffa9554a6b1 17781 nbconvert_5.4-2+deb10u1_amd64.buildinfo Files: 3d03d37ca023957f5c03ae6f22ae11a8 3365 python optional nbconvert_5.4-2+deb10u1.dsc f07cdd9e4df732dc218aa0c134fa4600 501336 python optional nbconvert_5.4.orig.tar.gz b43cd5d15cd88abf4784852967412335 15844 python optional nbconvert_5.4-2+deb10u1.debian.tar.xz 1a71bdc479a018af2cb4f882cc1111f7 17781 python optional nbconvert_5.4-2+deb10u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmR6pccACgkQ05pJnDwh pVIM9Q//Qoe51AeZ1hb6drFlSuHc3clGKo2JWRPdZsqKt7Nlj2hyrb+RmRB9ojYi qul5upeb/uBNSMTWDrkrK+EBWZDJbt6ytn/NJwSBn54vbiOTB0+3sI3BUkXMmz1s YPfmSFFrvjOyMMrpaBPgqlk9PjhRvzMz5bg3Ud0uYLxcM6QuDzHCTPC5INfyjG+i I7mKSmmoczLXk1eKvf8XhnbkEb6EHG/VZd3FJuCfB5SkEA89MST4v4oqi3aqUzel suvvH48EoVyHekaB4E5rTzL8vNqZtQnQMIQQz+cJ7fi8H0cqYACCj5v67tIkgDBh vYK8bc76Gn/37wnTQ14f2sgN3JFLPtMRdiYeNMRIfBLPn6FccfZ3ZCihbYAtiDzk 5qd/6QYmg+tLKrO3sbeoJlx9GU4h9D2YyFpgGU4SIhjbTOPMlPIdicjDI4n0Er5t puAQBU+b9W/fXNwu3qYq8p5AVV0fHt5r9Z4YTU8g47PSIjB6TUNNO4w7NIEGqMq2 E67hJ82scs1j0GLKK7ohlxa+ZiuVgrkwAIUnbkKglLbtzBpjO++o/gLNCnt111zr oudyfUGA+DBV3qsOW6C+GHmGomrOof2k4uk+6hilebbxv6ag8BfsJ8V99UFbBgtD DbBm904nzAmuLk0b29xZqIE+gqgQokeBMUnmyGmds2C9DCjNkjM= =tjog -----END PGP SIGNATURE-----
