Brandon Williams created CASSANDRA-18150:
--------------------------------------------
Summary: Prefer snakeyaml's SafeConstructor over Constructor
Key: CASSANDRA-18150
URL: https://issues.apache.org/jira/browse/CASSANDRA-18150
Project: Cassandra
Issue Type: Improvement
Reporter: Brandon Williams
CVE-2022-1471 allows RCE through the Constructor class. While this isn't a
concern since yaml is only used for configuration, it is simple enough to
switch to SafeConstructor and harden the server a little more.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org
For additional commands, e-mail: commits-h...@cassandra.apache.org
