swagger-parser icon indicating copy to clipboard operation
swagger-parser copied to clipboard

Published 20 hours ago • verified publisher icon swagger-api

CVE-2022-1471 in SnakeYAML 1.33

Open dkirrane opened this issue 2 years ago • 1 comments

Out project reports the following CVE when we use latest io.swagger.parser.v3:swagger-parser:2.1.18 https://nvd.nist.gov/vuln/detail/CVE-2022-1471

Is it possible to move to SnakeYaml v2 to resolve this CVE?

dkirrane avatar Nov 15 '23 12:11 dkirrane

2.1.8 and current swagger-parser uses SnakeYaml 2.2, which is not affected by the mentioned vulnerability. Please verify that your tooling is providing correct result and targeting the right version, and please close ticket if the above is correct

frantuma avatar Nov 16 '23 14:11 frantuma