swagger-api / swagger-api/swagger-codegen
[Security] Update vulnerable libraries
Open
@gracekarina is already working on this.
Since Apr 22, 2020.
- Dominant language
- Mustache
- Stars
- 17.8k
- Forks
- 6k
- PR merge metrics
- No merged PRs in 30d
Description
Description
I added your library to my project and run https://www.owasp.org/index.php/OWASP_Dependency_Check on it.
It gave me the following list of vulnerable libraries that you use:
- handlebars-4.1.2.jar: handlebars-v4.0.4.js, more info here
- swagger-codegen-2.4.9.jar: gradle-wrapper.jar, cve1, cve2, cve3, cve4
- swagger-codegen-2.4.9.jar: jquery-1.8.3.min.js, cve1, cve2,cve3
Swagger-codegen version
I added implementation 'io.swagger.codegen.v3:swagger-codegen:3.0.13' to my build.gradle
Steps to reproduce
-
Add implementation 'io.swagger.codegen.v3:swagger-codegen:3.0.13'
-
Add https://github.com/jeremylong/DependencyCheck as a gradle plugin (https://github.com/jeremylong/dependency-check-gradle)
-
Run
gradle dependencyCheckAnalyze --infoand see the vulnerabilities.
Fix
Update the vulnerable libraries
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.