SnakeYAML 1.27 vulnerability in Jinjava 2.7.1
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 35/100
Research direction
Start by locating the Maven dependency declaration that brings SnakeYAML into Jinjava, then inspect the referenced Jinjava and Jackson YAML versions. Run the existing test suite after selecting a non-vulnerable compatible version; done means the dependency is upgraded without regressions and the reported SnakeYAML vulnerabilities are resolved.
Written by the indexing model from the issue text.
Description
Hi Team,
We recently found out that SnakeYAML library 1.27 has some vulnerabilities which are fixed in later versions-
snakeyaml 1.27 1.31 java-archive GHSA-3mc7-4q67-w48m High
snakeyaml 1.27 1.31 java-archive GHSA-98wm-3w3q-mw94 Medium
snakeyaml 1.27 1.31 java-archive GHSA-c4r9-r8fh-9vj2 Medium
snakeyaml 1.27 1.31 java-archive GHSA-hhhw-99gj-p3c3 Medium
snakeyaml 1.27 1.32 java-archive GHSA-9w3m-gqgf-c4p9 Medium
snakeyaml 1.27 1.32 java-archive GHSA-w37g-rhq8-7m4j Medium
snakeyaml 1.27 2.0 java-archive GHSA-mjmj-j48q-9wg2 High
I traced down the version of Snakeyaml for the 2.7.1 Jinjava -
Maven Repository: com.hubspot.jinjava » jinjava » 2.7.1
As per their POM https://repo1.maven.org/maven2/com/hubspot/jinjava/jinjava/2.7.0/jinjava-2.7.0.pom
Maven Repository: com.fasterxml.jackson.dataformat » jackson-dataformat-yaml » 2.12.6
-->
https://repo1.maven.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.12.6/jackson-dataformat-yaml-2.12.6.pom
--> SnakeYAML 1.27
Could we please prioritize this for the next release ? This will be a great relief for all the users.
Regards,
Souptik
- Dominant language
- Java
- Stars
- 785
- Forks
- 184
- Avg merge
- 6d 22h
- Merged PRs (30d)
- 1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from HubSpot/jinjava
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
-
Jinjava 3.0 Open
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
Similar issues
-
awaiting triage bug Causes friction Hop Gui P1 P2 Transforms
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
apache/flink-agents#1152 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
jenkinsci/blueocean-plugin#5417 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
objectionary/eo-graphs#75 ·