PT-2017-10905 · Smartbear · Swagger Codegen+1
M-Y-Mo
·
Publicado
2017-11-27
·
Atualizado
2019-10-03
·
CVE-2017-1000207
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Swagger-Parser versions <= 1.0.30
Swagger codegen versions <= 2.2.2
Description
A vulnerability in Swagger-Parser's yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This affects the 'generate' and 'validate' commands in swagger-codegen and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
Recommendations
For Swagger-Parser versions <= 1.0.30, update to a version greater than 1.0.30 to resolve the issue.
For Swagger codegen versions <= 2.2.2, update to a version greater than 2.2.2 to resolve the issue.
As a temporary workaround, consider restricting the use of the 'generate' and 'validate' commands in swagger-codegen until a patch is available.
Correção
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Swagger Codegen
Swagger-Parser