[STORM-3918] Bump snakeyaml from 1.32 to 2.0

• Type: Dependency upgrade
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.4.0
• Fix Version/s: 2.5.0
• Component/s: storm-core
• Assignee: Alexandre Vermeerbergen
• Reporter: Alexandre Vermeerbergen
• Created: 12/May/23 12:49
• Updated: 14/Jun/23 18:22
• Resolved: 14/Jun/23 00:30

Description

Current snakeyaml version is vulnerable to CVE-2022-1471 which is rated 9.8 CRITICAL by NIST.

Trivial fix is to update to snakeyaml 2.0.

I tried to manually replace existing snakeyaml JAR with 2.0 version (but keeping the same JAR file name to avoid issue with potentially hard coded CLASSPATH), and then I restarted all Storm related processes (Nimbus, logview, Supervisor, Nimbus UI...) and deployed some topologies => everything worked fine

So it looks like a trivial task

 

Issue Links

• is a clone of: STORM-3894 Bump snakeyaml from 1.32 to 2.0