cassandra_exporter icon indicating copy to clipboard operation
cassandra_exporter copied to clipboard

Published 20 hours ago • verified publisher icon criteo

Critical vulnerability in SnakeYaml (CVE-2022-1471)

Open pete-gillin-privitar opened this issue 1 year ago • 0 comments

In build.gradle there's a dependency on com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.13.1 which depends on org.yaml:snakeyaml:1.31 which is vulnerable to CVE-2022-1471, which NIST score as 9.8 CRITICAL. The fix is to upgrade jackson to 2.15, which upgrades to snakeyaml 2.0 (https://github.com/FasterXML/jackson-dataformats-text/pull/390).

pete-gillin-privitar avatar Apr 06 '23 16:04 pete-gillin-privitar