From 70b0673d85ba67c7c1129d4e50da72ee0d5dc5d9 Mon Sep 17 00:00:00 2001
From: Brandon Williams <brandonwilliams@apache.org>
Date: Tue, 20 Sep 2022 09:14:25 -0500
Subject: [PATCH] Supress CVE-2022-25857 et al for snakeyaml

Also suppresses CVE-2022-38752, CVE-2022-38751, CVE-2022-38750,
CVE-2022-25857, CVE-2022-38749

Patch by brandonwilliams; reviewed by smiklosovic for CASSANDRA-17907
---
 .build/dependency-check-suppressions.xml | 5 +++++
 CHANGES.txt                              | 1 +
 2 files changed, 6 insertions(+)

diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index 9aedeae594..28cbf593bd 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -24,6 +24,11 @@
         <!--  https://issues.apache.org/jira/browse/CASSANDRA-16150 -->
         <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
         <cve>CVE-2017-18640</cve>
+        <cve>CVE-2022-25857</cve>
+        <cve>CVE-2022-38749</cve>
+        <cve>CVE-2022-38750</cve>
+        <cve>CVE-2022-38751</cve>
+        <cve>CVE-2022-38752</cve>
     </suppress>
 
     <!-- https://issues.apache.org/jira/browse/CASSANDRA-15417 -->
diff --git a/CHANGES.txt b/CHANGES.txt
index 15d52685ba..d3031cd294 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
 3.11.14
+ * Suppress CVE-2022-25857 and other snakeyaml CVEs (CASSANDRA-17907)
  * Fix potential IndexOutOfBoundsException in PagingState in mixed mode clusters (CASSANDRA-17840)
  * Document usage of closed token intervals in manual compaction (CASSANDRA-17575)
  * Creating of a keyspace on insufficient number of replicas should filter out gosspping-only members (CASSANDRA-17759)