[CASSANDRA-18149] snakeyaml vulnerabilities: CVE-2021-4235, CVE-2022-1471, CVE-2022-3064

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.0.29, 3.11.15, 4.0.8, 4.1.1, 5.0-alpha1, 5.0
• Component/s: Dependencies
• Bug Category: Security
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Since Version: NA

Source Control Link

https://github.com/apache/cassandra/commit/9a64be32340829038e4895a667eda025d5219f1b

Test and Documentation Plan

run CI

• Assignee: Brandon Williams
• Reporter: Brandon Williams

Authors

Brandon Williams

Reviewers

Berenguer Blasi

• Created: 11/Jan/23 21:29
• Updated: Yesterday 08:54
• Resolved: 24/Jan/23 18:30

Description

The OWASP scan is reporting these for both snakeyaml-1.11 and snakeyaml-1.26.

These are similar to CASSANDRA-17907 in that they require access to the yaml to have any effect.

Issue Links

• is duplicated by: CASSANDRA-19141 Security vulnerabilities in SnakeYAML In Cassandra (CVE-2022-1471)
• is duplicated by: CASSANDRA-20094 snakeyaml1.26 still exists in apache-cassandra-5.0.2
• relates to: CASSANDRA-18150 Prefer snakeyaml's SafeConstructor over Constructor
• requires: CASSANDRA-18150 Prefer snakeyaml's SafeConstructor over Constructor