https://bugzilla.redhat.com/show_bug.cgi?id=1785376
Alex Scheel <ascheel(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |ascheel(a)redhat.com
Flags| |needinfo?(gsuckevi(a)redhat.c
| |om)
--- Comment #2 from Alex Scheel <ascheel(a)redhat.com> ---
What needs to be done here? Is there a specific patch that needs to be applied?
Upstream's position [0] seems to be that you need to be careful about what
inputs you give to snakeyaml. From a snakeyaml packager POV, there's not much
we can do if snakeyaml upstream won't fix it and we don't control how packages
use snakeyaml downstream or upstream. Would rebasing F30 to 1.25 (like F31 and
Rawhide are currently only) suffice, or is there something else required from
us? Does 1.25 solve the issue? It isn't immediately clear.
Otherwise I'm inclined to close the Fedora tracker with WONTFIX and point to
the upstream wiki.
[0]:
https://bitbucket.org/asomov/snakeyaml/wiki/Billion%20laughs%20attack
--
You are receiving this mail because:
You are on the CC list for the bug.