[BUG] Directory Traversal Vulnerability in swagger-parser 2.0.26/httpclient 4.5.2

Bug Report Checklist

• [na] Have you provided a full/minimal spec to reproduce the issue?
• [na] Have you validated the input using an OpenAPI validator (example)?
• Have you tested with the latest master to confirm the issue still exists?
• Have you searched for related issues/PRs?
• [na] What's the actual output vs expected output?
• [Optional] Sponsorship to speed up the bug fix or feature request (example)

Description

openapi-generator version 5.3.0 depends on swagger-parser 2.0.26 which eventually depends on httpclient version 4.5.2 which contains a network vulnerability.

Apache httpclient before 4.5.3 are vulnerable to Directory Traversal. The user-provided path was able to override the specified host, resulting in giving network access to a sensitive environment.

openapi-generator-gradle-plugin-5.3.0.jar (Root Library)
 \-openapi-generator-5.3.0.jar
   \-swagger-parser-2.0.26.jar
     \-swagger-parser-v2-converter-2.0.26.jar
       \-swagger-compat-spec-parser-1.0.55.jar
         \-❌ httpclient-4.5.2.jar (Vulnerable Library)

openapi-generator version

5.3.0

Suggest a fix

Update to swagger-parser 2.0.28

swagger-parser:jar:2.0.28
 \- swagger-parser-v2-converter:jar:2.0.28
   \- swagger-compat-spec-parser:jar:1.0.56
     \- httpclient:jar:4.5.12

Start by inspecting the dependency declarations for the openapi-generator-gradle-plugin and the dependency tree shown in the report. Update swagger-parser from 2.0.26 to 2.0.28, then verify that the resolved chain uses httpclient 4.5.12 and no longer includes httpclient 4.5.2.