Hugo security vulnerabilities

Gohugoio Hugo is a framework from the Gohugoio community based on the Go language for rapid generation of static sites. A security vulnerability exists in Hugo versions prior to v0.123.0, which stems from Markdown headers not being escaped in internal rendering hooks...

USN-6744-1 pillow vulnerability

Hugo van Kemenade discovered that Pillow was not properly performing bounds checks when processing an ICC file, which could lead to a buffer overflow. If a user or automated system were tricked into processing a specially crafted ICC file, an attacker could possibly use this issue to cause a deni...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2024-26130 via cryptography (2.0.0)

cryptography PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2024-26130 Source advisory: OSV:PYSEC-2024-225...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2023-50782 via cryptography (2.0.0)

cryptography PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2023-50782 Source advisory: OSV:GHSA-3WW4-GG4F-JR7F...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2024-0727 via cryptography (2.0.0)

cryptography PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2024-0727 Source advisory: OSV:GHSA-9V9H-CGJ8-H64P...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, ollama, sigstore-scaffolding, pulumi, slsa-verifier, bom, pulumi-kubernetes-operator, git-lfs, pulumi-language-java, gomplate, gobuster, dex, cue, fuse-overlayfs-snapshotter, weaviate, prometheus-adapter, nghttp2, kubeflow, kubevela, nri-prometheus,...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2023-54397 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2023-54397 Source advisory: OSV:GHSA-QPPV-J76H-2RPX...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2023-28370 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2023-28370 Source advisory: OSV:GHSA-HJ3F-6GCP-JG8J...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2023-28370 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2023-28370 Source advisory: OSV:PYSEC-2023-75...

[SECURITY] [DLA 3420-1] golang-websocket security update

Debian LTS Advisory DLA-3420-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany May 14, 2023 https://wiki.debian.org/LTS Package : golang-websocket Version : 1.4.0-1+deb10u1 CVE ID : CVE-2020-27813 An integer overflow vulnerability exists in golang-websocket, a Go...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2023-24816 via ipython (6.1.0)

ipython PYPI version 6.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ipython and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2023-24816 Source advisory: OSV:PYSEC-2023-17...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2023-24816 via ipython (6.1.0)

ipython PYPI version 6.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on ipython and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2023-24816 Source advisory: OSV:GHSA-29GW-9793-FVW7...

hugo-jupyter (>=0.2.1, <=0.3.0), modconf (>=0.4.0b7, <=0.4.0b9) +3 more potentially affected by CVE-2022-40897 via setuptools (36.2.0)

setuptools PYPI version 36.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - hugo-jupyter =0.2.1, =0.4.0b7, =0.5.0b10, =0.5.0b12 - ws-sheets-server 0.4.1b28 - ws-web-aiohttp 0.1.0b19 Source cves: CVE-2022-40897 Sourc...

io.jenkins.plugins:hugo (0.1.3) potentially affected by CVE-2022-38663 via org.jenkins-ci.plugins:git (3.9.0)

org.jenkins-ci.plugins:git MAVEN version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.jenkins.plugins:hugo 0.1.3 Source cves: CVE-2022-38663 Source advisory: OSV:GHSA-JXMW-3GXF-FPRH...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2021-32862 via nbconvert (5.2.1)

nbconvert PYPI version 5.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2021-32862 Source advisory: OSV:PYSEC-2022-249...

hugo-jupyter (>=0.2.1, <=0.3.0) potentially affected by CVE-2021-32862 via nbconvert (5.2.1)

nbconvert PYPI version 5.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - hugo-jupyter =0.2.1, =0.3.0 Source cves: CVE-2021-32862 Source advisory: OSV:GHSA-9JMQ-RX5F-8JWQ...

Fedora: Security Advisory for hugo (FEDORA-2022-5038c3236c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: hugo-0.93.3-6.fc36

Hugo is a static HTML and CSS website generator written in Go. It is optimized for speed, easy use and configurability. Hugo takes a directory with content and templates and renders them into a full HTML website...

io.jenkins.plugins:hugo (0.1.3) potentially affected by CVE-2022-36882 via org.jenkins-ci.plugins:git (3.9.0)

org.jenkins-ci.plugins:git MAVEN version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.jenkins.plugins:hugo 0.1.3 Source cves: CVE-2022-36882 Source advisory: OSV:GHSA-8XWJ-2WGH-GPRH...

io.jenkins.plugins:hugo (0.1.3) potentially affected by CVE-2022-36884 via org.jenkins-ci.plugins:git (3.9.0)

org.jenkins-ci.plugins:git MAVEN version 3.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:git and may be impacted: - io.jenkins.plugins:hugo 0.1.3 Source cves: CVE-2022-36884 Source advisory: OSV:GHSA-449W-C77C-VMF6...