Update swagger-parser version for known vulnerability
AlexandrosMor opened this issue · comments
Recently swagger-parser made a release to update the SnakeYAML. Recently, a vulnerability was discovered in SnakeYAML version 1.33 that could allow an attacker to execute arbitrary code during the deserialization process. To address this vulnerability, the SnakeYAML development team has released version 2.0, which includes several security enhancements and bug fixes.
The vulnerability in SnakeYAML 1.33 arises from the way the parser handles specially crafted YAML documents. An attacker could exploit this vulnerability by constructing a malicious YAML document that, when deserialized by SnakeYAML, executes arbitrary code on the system. This type of attack is known as a YAML deserialization attack.
To prevent this vulnerability, SnakeYAML 2.0 introduces several security measures. For example, the new version includes a safe constructor that restricts the types of objects that can be deserialized. It also includes a whitelist of safe classes that can be deserialized without risk of code execution.
In addition to these security enhancements, SnakeYAML 2.0 also includes several bug fixes and performance improvements. The new version is fully backwards-compatible with previous versions of SnakeYAML, so upgrading should be a straightforward process for most users.
Overall, the update to SnakeYAML from 1.33 to 2.0 is a critical security update that all users of SnakeYAML should install as soon as possible to protect against YAML deserialization attacks.
@joschi Are you planning to make a release soon ?
Resolved via #499
any plans for release ? @joschi