natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Supress CVE-2022-25857 et al for snakeyaml 

Also suppresses CVE-2022-38752, CVE-2022-38751, CVE-2022-38750,
CVE-2022-25857, CVE-2022-38749

Patch by brandonwilliams; reviewed by smiklosovic for CASSANDRA-17907
This commit is contained in:
Brandon Williams 2022-09-20 09:14:25 -05:00
parent 04c3e816e8
commit 70b0673d85
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.build/dependency-check-suppressions.xml
View File

@ -24,6 +24,11 @@
<!-- https://issues.apache.org/jira/browse/CASSANDRA-16150 -->
<packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
<cve>CVE-2017-18640</cve>
<cve>CVE-2022-25857</cve>
<cve>CVE-2022-38749</cve>
<cve>CVE-2022-38750</cve>
<cve>CVE-2022-38751</cve>
<cve>CVE-2022-38752</cve>
</suppress>
<!-- https://issues.apache.org/jira/browse/CASSANDRA-15417 -->

1
CHANGES.txt
View File

@ -1,4 +1,5 @@
3.11.14
* Suppress CVE-2022-25857 and other snakeyaml CVEs (CASSANDRA-17907)
* Fix potential IndexOutOfBoundsException in PagingState in mixed mode clusters (CASSANDRA-17840)
* Document usage of closed token intervals in manual compaction (CASSANDRA-17575)
* Creating of a keyspace on insufficient number of replicas should filter out gosspping-only members (CASSANDRA-17759)