[
https://issues.apache.org/jira/browse/CASSANDRA-18150?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17679683#comment-17679683
]
Berenguer Blasi commented on CASSANDRA-18150:
---------------------------------------------
[~brandon.williams] I tried googling 'could not determine a constructor for the
tag'. Is this the error you're referring to? Be it the case the search brought
up some useful info it might be worth pulling the thread. Sthg about scalars,
free-style objects, providing yourself some code to handle those...
> Prefer snakeyaml's SafeConstructor over Constructor
> ---------------------------------------------------
>
> Key: CASSANDRA-18150
> URL: https://issues.apache.org/jira/browse/CASSANDRA-18150
> Project: Cassandra
> Issue Type: Improvement
> Components: Local/Config
> Reporter: Brandon Williams
> Assignee: Brandon Williams
> Priority: Normal
> Fix For: 3.0.x, 3.11.x, 4.0.x, 4.1.x, 4.x
>
>
> CVE-2022-1471 allows RCE through the Constructor class. While this isn't a
> concern since yaml is only used for configuration, it is simple enough to
> switch to SafeConstructor and harden the server a little more.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
