Security vulnerabilities found in dependency YUI

[davidkhala]

YUI 2.9.0 has known vulnerabilities:
severity: high; CVE: CVE-2012-5883; http://www.cvedetails.com/cve/CVE-2012-5883/
severity: high; CVE: CVE-2012-5882; http://www.cvedetails.com/cve/CVE-2012-5882/
severity: high; CVE: CVE-2012-5881; http://www.cvedetails.com/cve/CVE-2012-5881/

[kjur]

jsrsasign uses very small part of YUI. Just object inheritance class definition. So those vulnerability are not affect to jsrsasign. Part of YUI code is planed to remove from jsrsasign in the future. Thank you.

[davidkhala]

Good to hear that.
The issue is created due to some static code scanner report.

[RasmusOlesen]

Hi @kjur

The problem isn't only which part of YUI that is being used by jsrasign.
People who are using jsrasign are forced to host a vulnerable version of YUI on their webserver.
Which might open up on or more attack-vectors using one or more of the known vulnerabilities in the library.

So please reconsider removing or updating this dependency as quickly as possible.