Mickael Maison created KAFKA-14198: -------------------------------------- Summary: Release package contains snakeyaml 1.30 Key: KAFKA-14198 URL: https://issues.apache.org/jira/browse/KAFKA-14198 Project: Kafka Issue Type: Improvement Affects Versions: 3.3.0 Reporter: Mickael Maison
snakeyaml 1.30 is vulnerable to CVE-2022-25857: https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360 It looks like we pull this dependency because of swagger. It's unclear how or even if this can be exploited in Kafka but it's flagged by scanning tools. I wonder if we could make the swagger dependency compile time only and avoid shipping them. -- This message was sent by Atlassian Jira (v8.20.10#820010)