[USN-6424-1] kramdown vulnerability

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmUk75sFAwAAAAAACgkQWNrRIKaTkWcZ
nBAAmdyt2nGTlkDayYm5VwG0/FcT5AH1VWyoFA1cgHt1r5nS7vckE9I2sUcAcvvUh8eHF2Gn1Ty3
7A8wKQuXA3t4nKhzfwfjk100MaiVYV8wL1rxjygZWpzOteGg2Ge9HuzY1goD6JS3c6cwoFFOp2fw
jiCTLQfGr5gGyyCPhwQMR064AjBHl7JOu8VIHzcBRIJMQG1/YU5jWZepSQO3N2/83c9nofbo5DG6
LS8jK1HTikFzYPp2TG68RT8dT/ol2rWIeZs8D+M1bLQXFUXEqGUupPBQVN2aGPKTfwI4gt7/E/41
iQmF90jaEKbufIIMnOhUHcYLis8nRsugIwP+pnIjYN7ony1SzE69qTP+7qqpzBssO2zC93lJoNST
q5NR+XhNaIkKtnRV24BAspVOwuL5GVUGcPqcHmPmMy1nizZVtzmmwdJ1gXOdvGVyAoRFRkamEvRd
0OG/0W9oxRRTOmNFFrSV522GbXc4P4yzjnLV+bgNxyYfxwJfOeCTg7tTuxi996c2zrtIB10EWI5g
ReQgR+ZDriwoeKXKtHpiNwj6Te6VguLghnJztpxT2c9UZHW21c5KPfEtBb6zrnrPZNjQfKi4MdRe
soawJaBhD79z0Il3BbV3L+hiMifB1FPYeKhGUwdTCPnnbJDEM3WxU9AY/LnPklf9vzlR26s9IYqS
6OQ=
=S2mP
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6424-1
October 10, 2023

ruby-kramdown vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS

Summary:

kramdown could be made to execute arbitrary code if it received specially
crafted input.

Software Description:
- ruby-kramdown: Fast, pure-Ruby Markdown-superset converter - ruby library

Details:

It was discovered that kramdown did not restrict Rouge formatters to the
correct namespace. An attacker could use this issue to cause kramdown to
execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
ruby-kramdown 1.17.0-4ubuntu0.2

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6424-1
CVE-2021-28834

Package Information:
https://launchpad.net/ubuntu/+source/ruby-kramdown/1.17.0-4ubuntu0.2