CVE-2022-1471 - Dependency Snakeyaml Critical 9.8 score vulnerability about uap-java

[jmini]

I think it is safe to update SnakeYAML to 2.0.

See release notes: https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes

PR for this project: #82

[ucjonathan]

Is there an ETA on when the next release will be made that contains 82 and/or 83?

[bpossolo]

I don’t have a specific eta but I will do it once I have some time to evaluate all the recent PRs and requests

[ucjonathan]

@bpossolo My suggestion would be to make a release that is only the individual pull request to update the SnakeYAML dependency as it has a security vulnerability.

[bpossolo]

from my understanding, the “security vulnerability” is not a real vulnerability as has been pointed out by the maintainers of snakeyml.
It’s only a vulnerability if youre using snakeyml to load untrusted content.

i need to figure out if the best path forward is to use a different lib (doesn’t introduce breaking change) or if it should be done at build time (introduced breaking change)