[Security] Pulsar client uses snakeyaml version and dependent on it libraries that have CVE-2022-1471
- Dominant language
- Java
- Stars
- 15.3k
- Forks
- 3.8k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 160
Description
### Search before asking
- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.
### Motivation
Snakeyaml v1.32 used in jackson.dataformat.yaml, prometheus and direct pulsar dependencies has a security vulnerability described in https://avd.aquasec.com/nvd/cve-2022-1471
### Solution
Update prometheus to 0.18.0, jackson libs to 2.15.0 and snakeyaml to 2.0
### Alternatives
_No response_
### Anything else?
_No response_
### Are you willing to submit a PR?
- [X] I'm willing to submit a PR!
Contributor guide
Research direction
No files or tests are named. Start by locating the dependency declarations and resolved versions for Prometheus, Jackson, and SnakeYAML; verify the requested versions can coexist and that the CVE is no longer present in the dependency scan.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100