bump snakeyaml to 2.0 and jackson to 2.14.2 #1894
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
AlexandrosMor
approved these changes
Mar 16, 2023
|
@lcharlois-neotys Can you update your branch ? Maybe that will help to get the approvals from the maintainers |
|
Hello @gracekarina @frantuma @char0n This is a know vulnerability in snakeyaml v1.33 please review it as the swagger-parser is used from multiple applications |
|
Quarkus 3.0.0.Alpha6 uses SnakeYaml 2.0, which breaks compatibility with swagger-parser. So, this bump is very important for Quarkus users. Contextualization: quarkusio/quarkus#31594 (comment) |
|
Here #1900 is a slightly different take on fixing this, which doesn't break compatibility with snakeyaml 1.33 |
Contributor
|
closing as replaced by #1906 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello,
This pull request is bumping
snakeyamlto 2.0 andjackson(includingjackson-databind) to 2.14.2.There are CVEs linked to this libraries:
I understand that the CVE-2022-1471 is not applicable to
swagger-parserbecause theSafeConstructoris used.However, I see that
snakeyamlhas been updated to version 2.0 onswagger-core.I'm also facing conflict issues in projects where there are imports from
snakeyaml1.30+and2.0.IMO, it will be good that
swagger-parserusesnakeyaml2.0.I've made the minimal changes: updating libraries version and use default constructor that is now safe by default with
2.0.Locally all tests are passing.
Regards,