Skip to content

Commit 3702930

Browse files
committed
Bump go-yaml version to cover fixed ddos heuristic
This PR bumbs go-yaml to v2.2.4, which has the ddos vulnerability fixed. Issue: go-yaml preceding 2.2.4 had vulnerability to ddos attack via billion laughs bomb. Such attack lead to program to be unresponsive. Issue has been described in https://raesene.github.io/blog/2019/10/15/From-stackoverflow-to-CVE/ Signed-off-by: Petr Kotas <[email protected]>
1 parent 61a733d commit 3702930

File tree

2 files changed

+3
-1
lines changed

2 files changed

+3
-1
lines changed

go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ require (
1010
github.com/go-openapi/swag v0.19.5
1111
github.com/go-openapi/validate v0.19.3
1212
github.com/stretchr/testify v1.4.0
13-
gopkg.in/yaml.v2 v2.2.2
13+
gopkg.in/yaml.v2 v2.2.4
1414
)
1515

1616
go 1.13

go.sum

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,3 +145,5 @@ gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8
145145
gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
146146
gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
147147
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
148+
gopkg.in/yaml.v2 v2.2.4 h1:/eiJrUcujPVeJ3xlSWaiNi3uSVmDGBK1pDHUHAnao1I=
149+
gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

0 commit comments

Comments
 (0)