search

launchdarkly / java-server-sdk

LaunchDarkly Server-Side SDK for Java
Other
83 stars 56 forks source link

Vulnerability CVE-2022-1471 is introduced via SnakeYaml 1.32. Upgrading to 2.0 should fix it. #300

Closed jasperbogers-ig closed 1 year ago

jasperbogers-ig commented 1 year ago

Describe the bug Launchdarkly java-server-sdk build.gradle has a dependency on SnakeYaml 1.32. That contains CVE-2022-1471. SnakeYaml 2.0 fixes it.

To reproduce Run a CVE scanner like OWASP dependencyCheck. It will flag this library, for example launchdarkly-java-server-sdk-6.0.5.jar/META-INF/maven/org.yaml/snakeyaml/pom.xml (pkg:maven/org.yaml/snakeyaml@1.32, cpe:2.3:a:snakeyaml_project:snakeyaml:1.32:*:*:*:*:*:*:*) : CVE-2022-1471

Expected behavior Using the LaunchDarkly java server SDK library shouldn't introduce a transitive SnakeYaml dependency that has a CVE.

SDK version 6.0.5

Language version, developer tools Java 17

OS/platform Ubuntu 22

Additional context See https://nvd.nist.gov/vuln/detail/CVE-2022-1471 and https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes

tanderson-ld commented 1 year ago

Hello @jasperbogers-ig,

Thank you for submitting this issue. We have filed it internally as 192272.

Thanks, Todd

louis-launchdarkly commented 1 year ago

Hello @jasperbogers-ig, we have released Java Server SDK 6.0.6 to address this issue. Please let us know if there is any other problem.

louis-launchdarkly commented 1 year ago

While LaunchDarkly recommends upgrading to the 6.x version of the SDK to get the Contexts support, the same fix is backported back to 5.x.