[CASSANDRA-18340] Bump snakeyaml from 1.26 to 2.0

• Type: New Feature
• Status: Resolved
• Priority: Normal
• Resolution: Duplicate
• Platform: All
• Assignee: Bipin Prasad
• Reporter: Bipin Prasad

Authors

Bipin Prasad

• Created: 16/Mar/23 19:09
• Updated: 17/Jul/23 15:07
• Resolved: 16/Mar/23 19:38

Description

snakeyaml 1.26 has CVEs. Bump version for snakeyaml from 1.26 to 2.0

To see the CVEs, goto https://mvnrepository.com/artifact/org.apache.cassandra/cassandra-all/4.1.0 and seach for org.yaml » snakeyaml under compile dependencies.Vulnerabilites are listed thusly:

 

Direct vulnerabilities:
CVE-2022-41854
CVE-2022-38752
CVE-2022-38751
View 4 more ...
Vulnerabilities from dependencies:
CVE-2022-22971
CVE-2022-22970
CVE-2022-22968

.............

Issue Links

• duplicates: CASSANDRA-18083 snakeyaml-1.26.jar: CVE-2022-41854
• is duplicated by: CASSANDRA-18672 Bump snakeyaml from 1.26 to 2.0
• links to: GitHub Pull Request #2224
• links to: GitHub Pull Request #2455