ssanjeevi / fastpages

Fast pages for LKG in IT portal

https://SSanjeevi.github.io/fastpages/

My Blog

powered by fastpages

What To Do Next?

Great! You have setup your repo. Now its time to start writing content. Some helpful links:

• Writing Blogs With Jupyter

• Writing Blogs With Markdown

• Writing Blog Posts With Word

• (Optional) Preview Your Blog Locally

Note: you may want to remove example blog posts from the _posts, _notebooks or _word folders (but leave them empty, don't delete these folders) if you don't want these blog posts to appear on your site.

Please use the nbdev & blogging channel in the fastai forums for any questions or feature requests.

fastpages's Issues

CVE-2020-26247 (Medium) detected in nokogiri-1.10.10.gem

CVE-2020-26247 - Medium Severity Vulnerability

Vulnerable Library - nokogiri-1.10.10.gem

Nokogiri (���) is an HTML, XML, SAX, and Reader parser. Among Nokogiri's many features is the ability to search documents via XPath or CSS3 selectors.

Library home page: https://rubygems.org/gems/nokogiri-1.10.10.gem

Dependency Hierarchy:

• jemoji-0.12.0.gem (Root Library)
  • html-pipeline-2.14.0.gem
    • ❌ nokogiri-1.10.10.gem (Vulnerable Library)

Found in HEAD commit: d662cb4a65c0b5cf384407ac114030614c2d8a7f

Found in base branch: master

Vulnerability Details

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri before version 1.11.0.rc4 there is an XXE vulnerability. XML Schemas parsed by Nokogiri::XML::Schema are trusted by default, allowing external resources to be accessed over the network, potentially enabling XXE or SSRF attacks. This behavior is counter to the security policy followed by Nokogiri maintainers, which is to treat all input as untrusted by default whenever possible. This is fixed in Nokogiri version 1.11.0.rc4.

Publish Date: 2020-12-30

URL: CVE-2020-26247

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/sparklemotion/nokogiri/releases/tag/v1.11.0.rc4

Release Date: 2020-12-30

Fix Resolution: 1.11.0.rc4

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-28834 (High) detected in kramdown-2.3.0.gem

CVE-2021-28834 - High Severity Vulnerability

Vulnerable Library - kramdown-2.3.0.gem

kramdown is yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions.

Library home page: https://rubygems.org/gems/kramdown-2.3.0.gem

Dependency Hierarchy:

• jekyll-seo-tag-2.6.1.gem (Root Library)
  • jekyll-4.1.1.gem
    • kramdown-parser-gfm-1.1.0.gem
      • ❌ kramdown-2.3.0.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

Publish Date: 2021-03-19

URL: CVE-2021-28834

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: rubysec/ruby-advisory-db@d06e48b

Release Date: 2021-03-19

Fix Resolution: 2.3.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-28965 (High) detected in rexml-3.2.4.gem

CVE-2021-28965 - High Severity Vulnerability

Vulnerable Library - rexml-3.2.4.gem

An XML toolkit for Ruby

Library home page: https://rubygems.org/gems/rexml-3.2.4.gem

Dependency Hierarchy:

• jekyll-seo-tag-2.6.1.gem (Root Library)
  • jekyll-4.1.1.gem
    • kramdown-parser-gfm-1.1.0.gem
      • kramdown-2.3.0.gem
        • ❌ rexml-3.2.4.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

Publish Date: 2021-04-21

URL: CVE-2021-28965

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cr8-4vfw-mr7h

Release Date: 2021-04-21

Fix Resolution: rexml - 3.2.5

---

Step up your Open Source Security Game with WhiteSource here