swagger-api / swagger-api/swagger-parser
There is a vulnerability in JavaMail in the jar of swagger parser
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 867
- Forks
- 560
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 7
Description
Hi I am working on China Company
We use the swagger parser package
But there is a JavaMail 1.4.3 in swagger parser package
The JavaMail 1.4.3 had vulnerability
The vulnerability information is as follows
https://rnd-vulncenter.huawei.com/vuln/toViewOfficialDetail?cveId=CVE-2007-6059
Can subsequent versions of swagger parser fix this problem
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the dependency declaration that brings JavaMail 1.4.3 into swagger-parser and review how that jar is packaged. Verify that the vulnerable JavaMail dependency is replaced or removed in a subsequent version, then run the repository's available build and dependency checks to confirm the packaged jar no longer contains it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100