Thanks a lot for the update! Thanks, Vijay
On Thu, Aug 25, 2016 at 12:10 AM, tony tam <[email protected]> wrote: > Hi, FYI swagger-ui 2.2.2 has been released and address XSS issues, > handlebars, and a whole host of other items. Please see here for release > notes: > > https://github.com/swagger-api/swagger-ui/releases/tag/v2.2.2 > > > On Thursday, August 4, 2016 at 8:30:42 AM UTC-7, Ron wrote: >> >> My bad, looks like we missed something, but we’re definitely working on >> it, will keep you posted. >> >> >> >> >> >> >> >> *From: *<[email protected]> on behalf of Ron >> Ratovsky <[email protected]> >> *Reply-To: *"[email protected]" < >> [email protected]> >> *Date: *Thursday, 4 August 2016 at 08:27 >> *To: *"[email protected]" < >> [email protected]> >> *Subject: *Re: Vulnerability in handlebars.js version 2.0.0 >> >> >> >> We’ve pushed the updated version to master yesterday, please check it out. >> >> >> >> >> >> >> >> *From: *<[email protected]> on behalf of Vijay < >> [email protected]> >> *Reply-To: *"[email protected]" < >> [email protected]> >> *Date: *Wednesday, 3 August 2016 at 23:00 >> *To: *Swagger <[email protected]> >> *Subject: *Re: Vulnerability in handlebars.js version 2.0.0 >> >> >> >> Hi Tony, >> >> >> >> I've not posted on this topic before. Anyways, good to know that it is >> being addressed. Any tentative date for this fix? >> >> >> >> Thanks, >> >> Vijay >> >> On Wednesday, August 3, 2016 at 8:23:31 PM UTC+5:30, tony tam wrote: >> >> Hi Vijay, I believe you already reached out on this. Expect it will be >> addressed shortly. >> >> >> >> On Aug 3, 2016, at 3:36 PM, Vijay <[email protected]> wrote: >> >> >> >> Hi, >> >> >> >> Our security team has found vulnerabilities in handlebars.js version >> 2.0.0 which is being used by Swagger UI. >> >> References provided: >> >> https://yahoo-security.tumblr.com/post/128130790295/paranoid >> -labs-open-source-and-solving-xss-in >> https://github.com/wycats/handlebars.js/pull/1083 >> https://blog.srcclr.com/handlebars_vulnerability_research_findings/ >> >> >> >> Is it already a known issue and being taken care to upgrade to >> handlebars.js latest stable version ? >> >> >> >> Thanks, >> >> Vijay >> >> >> >> >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Swagger" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. >> >> >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Swagger" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Swagger" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> For more options, visit https://groups.google.com/d/optout. >> > -- > You received this message because you are subscribed to a topic in the > Google Groups "Swagger" group. > To unsubscribe from this topic, visit https://groups.google.com/d/ > topic/swagger-swaggersocket/T-WVBjvpTw0/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "Swagger" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
