Vulnerability found in gopkg.in/yaml.v2 in versions < 2.2.8 (CVE-2019-11254) #9
Description
Our scans (using Mend) detected CVE-2019-11254 in the go-yaml package for versions <2.2.8. More details here
GHSA-wxc4-f4m6-wwqv
The recommended fix is to upgrade to at least https://github.com/go-yaml/yaml/tree/v2.2.8
From my understanding, the code in this module is based on an earlier version of go-yaml. Can the go-yaml code base be upgraded to address this vulnerability?