[
https://issues.apache.org/jira/browse/CASSANDRA-18149?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17676250#comment-17676250
]
Brandon Williams edited comment on CASSANDRA-18149 at 1/12/23 4:37 PM:
-----------------------------------------------------------------------
Patches to suppress these. We'll need to suppress 1471 even after
CASSANDRA-18150 is committed.
||Branch||CI||
|[3.0|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-3.0]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/757/workflows/1cb40cef-9b42-4e52-a0e5-738fc28e2fba]|
|[3.11|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-3.11]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/756/workflows/437ba05b-82a6-48d8-975e-d3a22fe8b2fe]|
|[4.0|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-4.0]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/754/workflows/fc941ea8-46a7-436f-8ea1-77c16466bf80],
[j11|https://app.circleci.com/pipelines/github/driftx/cassandra/754/workflows/2911192c-a53f-431d-971a-88ecdfe82837]|
|[4.1|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-4.1]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/758/workflows/9b75ac22-7f2b-486f-b922-90425da1f7d7],
[j11|https://app.circleci.com/pipelines/github/driftx/cassandra/758/workflows/e3091d43-b6a1-482c-99c4-2be1085ced05]|
|[trunk|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-trunk]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/755/workflows/4644601b-1723-4178-9d18-dc64e6ef720c],
[j11|https://app.circleci.com/pipelines/github/driftx/cassandra/755/workflows/ba37ace8-807f-40b2-bd45-50efd1837a61]|
was (Author: brandon.williams):
Patches to suppress these. We'll need to suppress 1471 even after
CASSANDRA-18150 is committed.
||Branch||CI||
|[3.0|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-3.0]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/757/workflows/1cb40cef-9b42-4e52-a0e5-738fc28e2fba]|
|[3.11|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-3.11]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/756/workflows/437ba05b-82a6-48d8-975e-d3a22fe8b2fe]|
|[4.0|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-4.0]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/754/workflows/fc941ea8-46a7-436f-8ea1-77c16466bf80],
[j11|https://app.circleci.com/pipelines/github/driftx/cassandra/754/workflows/2911192c-a53f-431d-971a-88ecdfe82837]|
|[4.1|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-4.1]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/758/workflows/9b75ac22-7f2b-486f-b922-90425da1f7d7],
[j11|https://app.circleci.com/pipelines/github/driftx/cassandra/758/workflows/e3091d43-b6a1-482c-99c4-2be1085ced05]|
|[trunk|https://github.com/driftx/cassandra/tree/CASSANDRA-18149-trunk]|[j8|https://app.circleci.com/pipelines/github/driftx/cassandra/758/workflows/9b75ac22-7f2b-486f-b922-90425da1f7d7],
[j11|https://app.circleci.com/pipelines/github/driftx/cassandra/758/workflows/e3091d43-b6a1-482c-99c4-2be1085ced05]|
> snakeyaml vulnerabilities: CVE-2021-4235, CVE-2022-1471, CVE-2022-3064
> ----------------------------------------------------------------------
>
> Key: CASSANDRA-18149
> URL: https://issues.apache.org/jira/browse/CASSANDRA-18149
> Project: Cassandra
> Issue Type: Bug
> Components: Dependencies
> Reporter: Brandon Williams
> Assignee: Brandon Williams
> Priority: Normal
> Fix For: 3.0.x, 3.11.x, 4.0.x, 4.1.x, 4.x
>
>
> The OWASP scan is reporting these for both snakeyaml-1.11 and snakeyaml-1.26.
> These are similar to CASSANDRA-17907 in that they require access to the yaml
> to have any effect.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
