[
https://issues.apache.org/jira/browse/CASSANDRA-18149?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17676250#comment-17676250
] Brandon Williams commented on CASSANDRA-18149: ---------------------------------------------- Patches to suppress these. We'll need to suppress 1471 even after CASSANDRA-18150 is committed. ||Branch||CI|| |[3.0|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-3.0]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/757/workflows/1cb40cef-9b42-4e52-a0e5-738fc28e2fba]| |[3.11|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-3.11]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/756/workflows/437ba05b-82a6-48d8-975e-d3a22fe8b2fe]| |[4.0|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-4.0]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/754/workflows/fc941ea8-46a7-436f-8ea1-77c16466bf80][j11|https://app.circleci.com/pipelines/github/driftx/cassandra/754/workflows/2911192c-a53f-431d-971a-88ecdfe82837]| |[4.1|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-4.1]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/758/workflows/9b75ac22-7f2b-486f-b922-90425da1f7d7][j11|https://app.circleci.com/pipelines/github/driftx/cassandra/758/workflows/e3091d43-b6a1-482c-99c4-2be1085ced05]| |[trunk|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-trunk]|[j8|][j11|https://app.circleci.com/pipelines/github/driftx/cassandra/758/workflows/e3091d43-b6a1-482c-99c4-2be1085ced05]| > snakeyaml vulnerabilities: CVE-2021-4235, CVE-2022-1471, CVE-2022-3064 > ---------------------------------------------------------------------- > > Key: CASSANDRA-18149 > URL: https://issues.apache.org/jira/browse/CASSANDRA-18149 > Project: Cassandra > Issue Type: Bug > Components: Dependencies > Reporter: Brandon Williams > Assignee: Brandon Williams > Priority: Normal > Fix For: 3.0.x, 3.11.x, 4.0.x, 4.1.x, 4.x > > > The OWASP scan is reporting these for both snakeyaml-1.11 and snakeyaml-1.26. > These are similar to CASSANDRA-17907 in that they require access to the yaml > to have any effect. -- This message was sent by Atlassian Jira (v8.20.10#820010) --------------------------------------------------------------------- To unsubscribe, e-mail: commits-unsubscr...@cassandra.apache.org For additional commands, e-mail: commits-h...@cassandra.apache.org
