This is an automated email from the ASF dual-hosted git repository.
lhotari pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pulsar.git
The following commit(s) were added to refs/heads/master by this push:
new e5d828a [Security] Use dependencyManagement to enforce snakeyaml
version to 1.30 (#13722)
e5d828a is described below
commit e5d828ac92f8102fc3c70d122b1270110757c591
Author: Lari Hotari <[email protected]>
AuthorDate: Wed Jan 12 17:03:17 2022 +0200
[Security] Use dependencyManagement to enforce snakeyaml version to 1.30
(#13722)
- snakeyaml changelog https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes
- Pulsar Offloaders contained vulnerable version 1.21
---
distribution/server/src/assemble/LICENSE.bin.txt | 2 +-
pom.xml | 7 +++++++
pulsar-sql/presto-distribution/LICENSE | 2 +-
3 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt
b/distribution/server/src/assemble/LICENSE.bin.txt
index 68297da..bc4638b 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -445,7 +445,7 @@ The Apache Software License, Version 2.0
- org.eclipse.jetty.websocket-websocket-servlet-9.4.43.v20210629.jar
- org.eclipse.jetty-jetty-alpn-conscrypt-server-9.4.43.v20210629.jar
- org.eclipse.jetty-jetty-alpn-server-9.4.43.v20210629.jar
- * SnakeYaml -- org.yaml-snakeyaml-1.27.jar
+ * SnakeYaml -- org.yaml-snakeyaml-1.30.jar
* RocksDB - org.rocksdb-rocksdbjni-6.10.2.jar
* Google Error Prone Annotations -
com.google.errorprone-error_prone_annotations-2.5.1.jar
* Apache Thrift - org.apache.thrift-libthrift-0.14.2.jar
diff --git a/pom.xml b/pom.xml
index 78738df..28ba1bc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -201,6 +201,7 @@ flexible messaging model and an intuitive client
API.</description>
<cron-utils.version>9.1.3</cron-utils.version>
<spring-context.version>5.3.1</spring-context.version>
<apache-http-client.version>4.5.13</apache-http-client.version>
+ <snakeyaml.version>1.30</snakeyaml.version>
<!-- test dependencies -->
<cassandra.version>3.6.0</cassandra.version>
@@ -1180,6 +1181,12 @@ flexible messaging model and an intuitive client
API.</description>
</dependency>
<dependency>
+ <groupId>org.yaml</groupId>
+ <artifactId>snakeyaml</artifactId>
+ <version>${snakeyaml.version}</version>
+ </dependency>
+
+ <dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
<version>${okhttp3.version}</version>
diff --git a/pulsar-sql/presto-distribution/LICENSE
b/pulsar-sql/presto-distribution/LICENSE
index c6840b8..1ae2877 100644
--- a/pulsar-sql/presto-distribution/LICENSE
+++ b/pulsar-sql/presto-distribution/LICENSE
@@ -394,7 +394,7 @@ The Apache Software License, Version 2.0
* RocksDB JNI
- rocksdbjni-6.10.2.jar
* SnakeYAML
- - snakeyaml-1.27.jar
+ - snakeyaml-1.30.jar
* Bean Validation API
- validation-api-2.0.1.Final.jar
* Objectsize
