Update dependency version of org.yaml.snakeyaml to 1.31 to resolve [CVE-2022-25857]

[diyfr]

CVE-2022-25857
Github commit snakeyaml
Bitbucket Issue
Bitbucket commit

[cowtowncoder]

Please elaborate. I don't have time to check out links trying to figure out what the ask is.

[diyfr]

Denial of Service (DoS) Affecting [org.yaml:snakeyaml] version < 0.1.31
ATTACK COMPLEXITY Low
How to fix?
Upgrade org.yaml:snakeyaml to version 1.31 or higher.

Affected versions of this package are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

[yawkat]

#328 already updated the snakeyaml version. Until a release of that is available, you can declare the dependency to 1.31 in your build explicitly.

[cowtowncoder]

@yawkat since there's a CVE maybe we should backport this into 2.13 branch, planning to release 2.13.4 relatively soon.

EDIT: 2.13.4 was released 2 weeks ago:

https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13.4

and has SnakeYAML 1.31 dependency. For older versions it should be possible to just force this version with Maven <dependencyManagement> override (and similarly using Gradle's alternative).

[AlexJacobs95]

Hello,
As another CVE-2022-38751 impacts snakeyaml version 1.31.
Is it possible to upgrade snakeyaml to version 1.32?
And release a new version once it's upgraded?
Thanks

[cowtowncoder]

@AlexJacobs95 We have done that in different PR, and it will be included in 2.13.5 and 2.14.0.
However, since we just released 2.13.4 actual fill 2.13.5 will be month or two away: it makes no sense to spend all the time (release takes 2-4 hours) for a single dependency update fix. 2.14.0-rc1 should be released within a week but full 2.14.0 is also at least 1 month away.

In the meantime, however, you can add an override to force 1.32 version to be used: this is fully compatible with earlier versions.
In Maven it's best done using <dependencyManagement> section; Gradle has something similar wrt implementation version.

[pjfanning]

snakeyaml 1.32 will probably only be supported in jackson 2.14.0 because it introduces a limit of 3Mb on the size of Yaml data that can be parsed. The 2.14.0 will allow the snakeyaml LoaderOptions to be set on the jackson YAMLFactory so that users can override the settings as they wish. #339

[wanjinyou]

snakeyaml 1.32 will probably only be supported in jackson 2.14.0 because it introduces a limit of 3Mb on the size of Yaml data that can be parsed. The 2.14.0 will allow the snakeyaml LoaderOptions to be set on the jackson YAMLFactory so that users can override the settings as they wish. #339

When can 2.14.0 get released? @pjfanning

[cowtowncoder]

@wanjinyou When it is ready. Hopefully within 2-3 weeks.