[CASSANDRA-18083] snakeyaml-1.26.jar: CVE-2022-41854

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.0.29, 3.11.15, 4.1.1, 5.0-alpha1, 5.0
• Component/s: Dependencies
• Bug Category: Security - Denial of Service
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Since Version: NA

Source Control Link

https://github.com/apache/cassandra/commit/92019df4d8540b384d7fb8655f7c02293f7f7ec1

Test and Documentation Plan

run CI

• Assignee: Brandon Williams
• Reporter: Brandon Williams

Authors

Brandon Williams

Reviewers

Berenguer Blasi

• Created: 30/Nov/22 15:22
• Updated: 12/Sep/23 13:03
• Resolved: 05/Dec/22 16:12

Description

https://nvd.nist.gov/vuln/detail/CVE-2022-41854

Issue Links

• is duplicated by: CASSANDRA-18340 Bump snakeyaml from 1.26 to 2.0