search

Yelp / bravado

Bravado is a python client library for Swagger 2.0 services
Other
605 stars 117 forks source link

Vulnerability in PyYAML #405

Open shawnsarwar opened 5 years ago

shawnsarwar commented 5 years ago

Bravado requires pyyaml, which currently has a known critical bug on versions <= 4.1

selection_027

Here'e a related thread from the pyyaml board:

macisamuele commented 5 years ago

@shawnsarwar bravado depends on PyYAML but it does not have requirement for a certain version of the library. Would be acceptable to add in your dependencies a min requirement for PyYAML such that the security of the final product is not impacted?