karate icon indicating copy to clipboard operation
karate copied to clipboard

Published 20 hours ago • verified publisher icon karatelabs

Upgrade snakeyaml from 1.29 to 1.31 fixing CVE-2022-25857

Open julianladisch opened this issue 2 years ago • 1 comments

Upgrading org.yaml:snakeyaml from 1.29 to 1.31 in karate-core fixes a Denial of Service (DoS) vulnerability caused by a missing nested depth limitation for collections.

https://nvd.nist.gov/vuln/detail/CVE-2022-25857

julianladisch avatar Sep 05 '22 13:09 julianladisch

@julianladisch thanks for the PR !

ptrthomas avatar Sep 05 '22 14:09 ptrthomas

1.3.0 released

ptrthomas avatar Nov 02 '22 17:11 ptrthomas