[CASSANDRA-17907] Remediate CVE-2022-25857 - org.yaml_snakeyaml version 1.26 has vulnerabilities

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.11.14, 4.0.7, 4.1-beta1, 4.1, 5.0-alpha1, 5.0
• Component/s: Dependencies
• Bug Category: Security - Denial of Service
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Since Version: NA

Source Control Link

https://github.com/apache/cassandra/commit/70b0673d85ba67c7c1129d4e50da72ee0d5dc5d9

Test and Documentation Plan

run CI

• Assignee: Brandon Williams
• Reporter: deepagkanaka

Authors

Brandon Williams

Reviewers

Stefan Miklosovic

• Created: 20/Sep/22 06:48
• Updated: 24/Oct/24 14:25
• Resolved: 21/Sep/22 10:58

Description

org.yaml_snakeyaml

CVE-2022-25857

Fixed in: 1.31 21 days ago

6

Impacted versions: <1.31 Discovered: a day ago Published: 21 days ago The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.