[KAFKA-14198] Release package contains snakeyaml 1.30

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.0
• Fix Version/s: 3.3.0
• Assignee: Ismael Juma
• Reporter: Mickael Maison
• Created: 02/Sep/22 09:17
• Updated: 12/Sep/22 16:34
• Resolved: 09/Sep/22 15:03

Description

snakeyaml 1.30 is vulnerable to CVE-2022-25857: https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360

It looks like we pull this dependency because of swagger. It's unclear how or even if this can be exploited in Kafka but it's flagged by scanning tools.

I wonder if we could make the swagger dependencies compile time only and avoid shipping them.

Issue Links

• is caused by: KAFKA-13780 Generate docs for Connect REST API
• links to: GitHub Pull Request #12609
• links to: GitHub Pull Request #12616