[CASSANDRA-18672] Bump snakeyaml from 1.26 to 2.0

• Type: New Feature
• Status: Resolved
• Priority: Normal
• Resolution: Duplicate
• Platform: All
• Assignee: Unassigned
• Reporter: Dinuth De Zoysa
• Created: 17/Jul/23 14:53
• Updated: 17/Jul/23 16:14
• Resolved: 17/Jul/23 15:07

Description

snakeyaml 1.26 has CVEs. Bump version for snakeyaml from 1.26 to 2.0

To see the CVEs, goto https://mvnrepository.com/artifact/org.apache.cassandra/cassandra-all/4.1.0 and seach for org.yaml » snakeyaml under compile dependencies.Vulnerabilites are listed thusly:

Direct vulnerabilities:
CVE-2022-41854
CVE-2022-38752
CVE-2022-38751
View 4 more ...
Vulnerabilities from dependencies:
CVE-2022-22971
CVE-2022-22970
CVE-2022-22968

GitHub Issue:

https://github.com/apache/cassandra/pull/2455

Issue Links

• duplicates: CASSANDRA-18340 Bump snakeyaml from 1.26 to 2.0