Security update - YAML parsing library (CVE-2019-11253) #1346
Description
Security update needed in YAML parsing library
Expected Behaviour
There was a vulnerability found in the YAML library used in Docker / K8s and OpenFaaS, we should update the CLI
Current Behaviour
Excessive resources can be consumed on the client or server if a particular nested/referential payload is used.
Possible Solution
Update vendored version of gopkg.in/yaml.v2 to v2.2.3
Affected areas
- OpenFaaS CLI https://github.com/openfaas/faas
- OpenFaaS Cloud bootstrap https://github.com/openfaas-incubator/ofc-bootstrap
- OpenFaaS Cloud deployment pipeline https://github.com/openfaas/openfaas-cloud/