Module
Core
Proposal
Currently the project is using Jackson databind yaml 2.8.x, and the comments on that part of the code say that this is for backwards compatibility.
Unfortunately that version uses an older version of snake yaml (1.17). This version has a known arbitrary code execution vulnerability, and it also fails to parse yaml that has >50 attributes, so it does not support more than 50 containers in a docker compose file.
jackson databind 2.8.x also has its own known vulnerabilitie: 1, 2.
I do not know what the compatibility issues the comment is referring to, but I think it's best to move to a newer version of jackson databind, even if it requires a new minor/major version.
Module
Core
Proposal
Currently the project is using Jackson databind yaml
2.8.x, and the comments on that part of the code say that this is for backwards compatibility.Unfortunately that version uses an older version of snake yaml (
1.17). This version has a known arbitrary code execution vulnerability, and it also fails to parse yaml that has >50 attributes, so it does not support more than 50 containers in a docker compose file.jackson databind
2.8.xalso has its own known vulnerabilitie: 1, 2.I do not know what the compatibility issues the comment is referring to, but I think it's best to move to a newer version of jackson databind, even if it requires a new minor/major version.