[CASSANDRA-18875] Upgrade the snakeyaml library version

• Type: Task
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 5.1-alpha1
• Component/s: Local/Config
• Change Category: Semantic
• Complexity: Normal
• Platform: All

Source Control Link

https://github.com/apache/cassandra/commit/64ae866095f0371daabbb82ac3cb80e979d79188

Test and Documentation Plan

run CI

• Assignee: Raymond Huffman
• Reporter: Jai Bheemsen Rao Dhanwada

Authors

Raymond Huffman

Reviewers

Brandon Williams, Stefan Miklosovic

• Created: 21/Sep/23 22:55
• Updated: 18/Dec/23 18:33
• Resolved: 01/Dec/23 18:43

Description

Apache cassandra uses 1.26 version of snakeyaml dependency and there are several vulnerabilities in this version that can be fixed by upgrading to 2.x version. I understand that this is not security issue as cassandra already uses SafeConstructor and is not a vulnerability under OWASP, so there are no plans to fix it as per  CASSANDRA-18122

 

Cassandra as a open source used and distributed by many enterprise customers and also when downloading cassandra as tar and using it external scanners are not aware of the implementation of SafeConstructor have no idea if it's vulnerable or not. 

Can we consider upgrading the version to 2.x in the next releases as snakeyaml is not something that has a large dependency between the major and minor versions. I am happy to open a PR for this. Please let me know your thoughts on this.

Issue Links

• links to: GitHub Pull Request #2941