CVE-2017-1000207: High severity smartbear swagger codegen vulnerability
A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000207?
CVE-2017-1000207 is classified as a high severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2017-1000207?
To fix CVE-2017-1000207, update Swagger-Parser to version 1.0.31 or later and Swagger Codegen to version 2.2.3 or later.
What versions are affected by CVE-2017-1000207?
CVE-2017-1000207 affects Swagger-Parser version 1.0.30 and earlier, and Swagger Codegen version 2.2.2 and earlier.
What type of vulnerability is CVE-2017-1000207?
CVE-2017-1000207 is a code injection vulnerability that arises from insecure YAML parsing.
Who is impacted by CVE-2017-1000207?
Developers and users of Swagger-Parser and Swagger Codegen who rely on these versions are directly impacted by CVE-2017-1000207.