https://bugzilla.redhat.com/show_bug.cgi?id=1785376
Alex Scheel ascheel@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ascheel@redhat.com Flags| |needinfo?(gsuckevi@redhat.c | |om)
--- Comment #2 from Alex Scheel ascheel@redhat.com --- What needs to be done here? Is there a specific patch that needs to be applied?
Upstream's position [0] seems to be that you need to be careful about what inputs you give to snakeyaml. From a snakeyaml packager POV, there's not much we can do if snakeyaml upstream won't fix it and we don't control how packages use snakeyaml downstream or upstream. Would rebasing F30 to 1.25 (like F31 and Rawhide are currently only) suffice, or is there something else required from us? Does 1.25 solve the issue? It isn't immediately clear.
Otherwise I'm inclined to close the Fedora tracker with WONTFIX and point to the upstream wiki.
[0]: https://bitbucket.org/asomov/snakeyaml/wiki/Billion%20laughs%20attack