apache/kyuubi
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity
d68507d239
kyuubi/dev/dependencyList
pengqli 9b93e874a0 [KYUUBI #5293] upgrade snakeyaml from 1.33 to 2.2 
### _Why are the changes needed?_

upgrade  snakeyaml from 1.33 to 2.2 reducing direct CVE vulnerabilities, see (https://bitbucket.org/snakeyaml/snakeyaml/wiki/Changes)
[CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471)
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.

### _How was this patch tested?_
- [ ] Add some test cases that check the changes thoroughly including negative and positive cases if possible

- [ ] Add screenshots for manual tests if appropriate

- [x] [Run test](https://kyuubi.readthedocs.io/en/master/contributing/code/testing.html#running-tests) locally before make a pull request

### _Was this patch authored or co-authored using generative AI tooling?_

No

Closes #5293 from dev-lpq/snakeyaml_critical.

Closes #5293

5b2412d8e [pengqli] upgrade  snakeyaml from 1.33 to 2.2

Authored-by: pengqli <pengqli@cisco.com>
Signed-off-by: Cheng Pan <chengpan@apache.org>
2023-09-15 11:32:09 +00:00

201 lines
10 KiB
Plaintext
Raw Blame History

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
HikariCP/4.0.3//HikariCP-4.0.3.jar
ST4/4.3.4//ST4-4.3.4.jar
animal-sniffer-annotations/1.21//animal-sniffer-annotations-1.21.jar
annotations/4.1.1.4//annotations-4.1.1.4.jar
antlr-runtime/3.5.3//antlr-runtime-3.5.3.jar
antlr4-runtime/4.9.3//antlr4-runtime-4.9.3.jar
aopalliance-repackaged/2.6.1//aopalliance-repackaged-2.6.1.jar
arrow-format/12.0.0//arrow-format-12.0.0.jar
arrow-memory-core/12.0.0//arrow-memory-core-12.0.0.jar
arrow-memory-netty/12.0.0//arrow-memory-netty-12.0.0.jar
arrow-vector/12.0.0//arrow-vector-12.0.0.jar
classgraph/4.8.138//classgraph-4.8.138.jar
commons-codec/1.15//commons-codec-1.15.jar
commons-collections/3.2.2//commons-collections-3.2.2.jar
commons-lang/2.6//commons-lang-2.6.jar
commons-lang3/3.13.0//commons-lang3-3.13.0.jar
commons-logging/1.1.3//commons-logging-1.1.3.jar
derby/10.14.2.0//derby-10.14.2.0.jar
error_prone_annotations/2.14.0//error_prone_annotations-2.14.0.jar
failsafe/2.4.4//failsafe-2.4.4.jar
failureaccess/1.0.1//failureaccess-1.0.1.jar
flatbuffers-java/1.12.0//flatbuffers-java-1.12.0.jar
fliptables/1.0.2//fliptables-1.0.2.jar
grpc-api/1.53.0//grpc-api-1.53.0.jar
grpc-context/1.53.0//grpc-context-1.53.0.jar
grpc-core/1.53.0//grpc-core-1.53.0.jar
grpc-grpclb/1.53.0//grpc-grpclb-1.53.0.jar
grpc-netty/1.53.0//grpc-netty-1.53.0.jar
grpc-protobuf-lite/1.53.0//grpc-protobuf-lite-1.53.0.jar
grpc-protobuf/1.53.0//grpc-protobuf-1.53.0.jar
grpc-stub/1.53.0//grpc-stub-1.53.0.jar
gson/2.9.0//gson-2.9.0.jar
guava/32.0.1-jre//guava-32.0.1-jre.jar
hadoop-client-api/3.3.6//hadoop-client-api-3.3.6.jar
hadoop-client-runtime/3.3.6//hadoop-client-runtime-3.3.6.jar
hive-common/3.1.3//hive-common-3.1.3.jar
hive-metastore/3.1.3//hive-metastore-3.1.3.jar
hive-serde/3.1.3//hive-serde-3.1.3.jar
hive-service-rpc/3.1.3//hive-service-rpc-3.1.3.jar
hive-shims-0.23/3.1.3//hive-shims-0.23-3.1.3.jar
hive-shims-common/3.1.3//hive-shims-common-3.1.3.jar
hive-standalone-metastore/3.1.3//hive-standalone-metastore-3.1.3.jar
hive-storage-api/2.7.0//hive-storage-api-2.7.0.jar
hk2-api/2.6.1//hk2-api-2.6.1.jar
hk2-locator/2.6.1//hk2-locator-2.6.1.jar
hk2-utils/2.6.1//hk2-utils-2.6.1.jar
httpclient/4.5.14//httpclient-4.5.14.jar
httpcore/4.4.16//httpcore-4.4.16.jar
httpmime/4.5.14//httpmime-4.5.14.jar
j2objc-annotations/1.3//j2objc-annotations-1.3.jar
jackson-annotations/2.15.0//jackson-annotations-2.15.0.jar
jackson-core/2.15.0//jackson-core-2.15.0.jar
jackson-databind/2.15.0//jackson-databind-2.15.0.jar
jackson-dataformat-yaml/2.15.0//jackson-dataformat-yaml-2.15.0.jar
jackson-datatype-jdk8/2.15.0//jackson-datatype-jdk8-2.15.0.jar
jackson-datatype-jsr310/2.15.0//jackson-datatype-jsr310-2.15.0.jar
jackson-jaxrs-base/2.15.0//jackson-jaxrs-base-2.15.0.jar
jackson-jaxrs-json-provider/2.15.0//jackson-jaxrs-json-provider-2.15.0.jar
jackson-module-jaxb-annotations/2.15.0//jackson-module-jaxb-annotations-2.15.0.jar
jackson-module-scala_2.12/2.15.0//jackson-module-scala_2.12-2.15.0.jar
jakarta.annotation-api/1.3.5//jakarta.annotation-api-1.3.5.jar
jakarta.inject/2.6.1//jakarta.inject-2.6.1.jar
jakarta.servlet-api/4.0.4//jakarta.servlet-api-4.0.4.jar
jakarta.validation-api/2.0.2//jakarta.validation-api-2.0.2.jar
jakarta.ws.rs-api/2.1.6//jakarta.ws.rs-api-2.1.6.jar
jakarta.xml.bind-api/2.3.2//jakarta.xml.bind-api-2.3.2.jar
javassist/3.25.0-GA//javassist-3.25.0-GA.jar
jcl-over-slf4j/1.7.36//jcl-over-slf4j-1.7.36.jar
jersey-client/2.39.1//jersey-client-2.39.1.jar
jersey-common/2.39.1//jersey-common-2.39.1.jar
jersey-container-servlet-core/2.39.1//jersey-container-servlet-core-2.39.1.jar
jersey-entity-filtering/2.39.1//jersey-entity-filtering-2.39.1.jar
jersey-hk2/2.39.1//jersey-hk2-2.39.1.jar
jersey-media-json-jackson/2.39.1//jersey-media-json-jackson-2.39.1.jar
jersey-media-multipart/2.39.1//jersey-media-multipart-2.39.1.jar
jersey-server/2.39.1//jersey-server-2.39.1.jar
jetcd-api/0.7.3//jetcd-api-0.7.3.jar
jetcd-common/0.7.3//jetcd-common-0.7.3.jar
jetcd-core/0.7.3//jetcd-core-0.7.3.jar
jetcd-grpc/0.7.3//jetcd-grpc-0.7.3.jar
jetty-client/9.4.52.v20230823//jetty-client-9.4.52.v20230823.jar
jetty-http/9.4.52.v20230823//jetty-http-9.4.52.v20230823.jar
jetty-io/9.4.52.v20230823//jetty-io-9.4.52.v20230823.jar
jetty-proxy/9.4.52.v20230823//jetty-proxy-9.4.52.v20230823.jar
jetty-security/9.4.52.v20230823//jetty-security-9.4.52.v20230823.jar
jetty-server/9.4.52.v20230823//jetty-server-9.4.52.v20230823.jar
jetty-servlet/9.4.52.v20230823//jetty-servlet-9.4.52.v20230823.jar
jetty-util-ajax/9.4.52.v20230823//jetty-util-ajax-9.4.52.v20230823.jar
jetty-util/9.4.52.v20230823//jetty-util-9.4.52.v20230823.jar
jline/0.9.94//jline-0.9.94.jar
jul-to-slf4j/1.7.36//jul-to-slf4j-1.7.36.jar
kafka-clients/3.4.0//kafka-clients-3.4.0.jar
kubernetes-client-api/6.8.1//kubernetes-client-api-6.8.1.jar
kubernetes-client/6.8.1//kubernetes-client-6.8.1.jar
kubernetes-httpclient-okhttp/6.8.1//kubernetes-httpclient-okhttp-6.8.1.jar
kubernetes-model-admissionregistration/6.8.1//kubernetes-model-admissionregistration-6.8.1.jar
kubernetes-model-apiextensions/6.8.1//kubernetes-model-apiextensions-6.8.1.jar
kubernetes-model-apps/6.8.1//kubernetes-model-apps-6.8.1.jar
kubernetes-model-autoscaling/6.8.1//kubernetes-model-autoscaling-6.8.1.jar
kubernetes-model-batch/6.8.1//kubernetes-model-batch-6.8.1.jar
kubernetes-model-certificates/6.8.1//kubernetes-model-certificates-6.8.1.jar
kubernetes-model-common/6.8.1//kubernetes-model-common-6.8.1.jar
kubernetes-model-coordination/6.8.1//kubernetes-model-coordination-6.8.1.jar
kubernetes-model-core/6.8.1//kubernetes-model-core-6.8.1.jar
kubernetes-model-discovery/6.8.1//kubernetes-model-discovery-6.8.1.jar
kubernetes-model-events/6.8.1//kubernetes-model-events-6.8.1.jar
kubernetes-model-extensions/6.8.1//kubernetes-model-extensions-6.8.1.jar
kubernetes-model-flowcontrol/6.8.1//kubernetes-model-flowcontrol-6.8.1.jar
kubernetes-model-gatewayapi/6.8.1//kubernetes-model-gatewayapi-6.8.1.jar
kubernetes-model-metrics/6.8.1//kubernetes-model-metrics-6.8.1.jar
kubernetes-model-networking/6.8.1//kubernetes-model-networking-6.8.1.jar
kubernetes-model-node/6.8.1//kubernetes-model-node-6.8.1.jar
kubernetes-model-policy/6.8.1//kubernetes-model-policy-6.8.1.jar
kubernetes-model-rbac/6.8.1//kubernetes-model-rbac-6.8.1.jar
kubernetes-model-resource/6.8.1//kubernetes-model-resource-6.8.1.jar
kubernetes-model-scheduling/6.8.1//kubernetes-model-scheduling-6.8.1.jar
kubernetes-model-storageclass/6.8.1//kubernetes-model-storageclass-6.8.1.jar
libfb303/0.9.3//libfb303-0.9.3.jar
libthrift/0.9.3//libthrift-0.9.3.jar
log4j-1.2-api/2.20.0//log4j-1.2-api-2.20.0.jar
log4j-api/2.20.0//log4j-api-2.20.0.jar
log4j-core/2.20.0//log4j-core-2.20.0.jar
log4j-slf4j-impl/2.20.0//log4j-slf4j-impl-2.20.0.jar
logging-interceptor/3.12.12//logging-interceptor-3.12.12.jar
lz4-java/1.8.0//lz4-java-1.8.0.jar
metrics-core/4.2.8//metrics-core-4.2.8.jar
metrics-jmx/4.2.8//metrics-jmx-4.2.8.jar
metrics-json/4.2.8//metrics-json-4.2.8.jar
metrics-jvm/4.2.8//metrics-jvm-4.2.8.jar
mimepull/1.9.15//mimepull-1.9.15.jar
netty-all/4.1.93.Final//netty-all-4.1.93.Final.jar
netty-buffer/4.1.93.Final//netty-buffer-4.1.93.Final.jar
netty-codec-dns/4.1.93.Final//netty-codec-dns-4.1.93.Final.jar
netty-codec-http/4.1.93.Final//netty-codec-http-4.1.93.Final.jar
netty-codec-http2/4.1.93.Final//netty-codec-http2-4.1.93.Final.jar
netty-codec-socks/4.1.93.Final//netty-codec-socks-4.1.93.Final.jar
netty-codec/4.1.93.Final//netty-codec-4.1.93.Final.jar
netty-common/4.1.93.Final//netty-common-4.1.93.Final.jar
netty-handler-proxy/4.1.93.Final//netty-handler-proxy-4.1.93.Final.jar
netty-handler/4.1.93.Final//netty-handler-4.1.93.Final.jar
netty-resolver-dns/4.1.93.Final//netty-resolver-dns-4.1.93.Final.jar
netty-resolver/4.1.93.Final//netty-resolver-4.1.93.Final.jar
netty-transport-classes-epoll/4.1.93.Final//netty-transport-classes-epoll-4.1.93.Final.jar
netty-transport-native-epoll/4.1.93.Final/linux-aarch_64/netty-transport-native-epoll-4.1.93.Final-linux-aarch_64.jar
netty-transport-native-epoll/4.1.93.Final/linux-x86_64/netty-transport-native-epoll-4.1.93.Final-linux-x86_64.jar
netty-transport-native-unix-common/4.1.93.Final//netty-transport-native-unix-common-4.1.93.Final.jar
netty-transport/4.1.93.Final//netty-transport-4.1.93.Final.jar
okhttp-urlconnection/3.14.9//okhttp-urlconnection-3.14.9.jar
okhttp/3.12.12//okhttp-3.12.12.jar
okio/1.15.0//okio-1.15.0.jar
osgi-resource-locator/1.0.3//osgi-resource-locator-1.0.3.jar
paranamer/2.8//paranamer-2.8.jar
perfmark-api/0.25.0//perfmark-api-0.25.0.jar
proto-google-common-protos/2.9.0//proto-google-common-protos-2.9.0.jar
protobuf-java-util/3.21.7//protobuf-java-util-3.21.7.jar
protobuf-java/3.21.7//protobuf-java-3.21.7.jar
scala-library/2.12.18//scala-library-2.12.18.jar
scopt_2.12/4.1.0//scopt_2.12-4.1.0.jar
simpleclient/0.16.0//simpleclient-0.16.0.jar
simpleclient_common/0.16.0//simpleclient_common-0.16.0.jar
simpleclient_dropwizard/0.16.0//simpleclient_dropwizard-0.16.0.jar
simpleclient_servlet/0.16.0//simpleclient_servlet-0.16.0.jar
simpleclient_servlet_common/0.16.0//simpleclient_servlet_common-0.16.0.jar
simpleclient_tracer_common/0.16.0//simpleclient_tracer_common-0.16.0.jar
simpleclient_tracer_otel/0.16.0//simpleclient_tracer_otel-0.16.0.jar
simpleclient_tracer_otel_agent/0.16.0//simpleclient_tracer_otel_agent-0.16.0.jar
slf4j-api/1.7.36//slf4j-api-1.7.36.jar
snakeyaml-engine/2.6//snakeyaml-engine-2.6.jar
snakeyaml/2.2//snakeyaml-2.2.jar
snappy-java/1.1.8.4//snappy-java-1.1.8.4.jar
sqlite-jdbc/3.42.0.0//sqlite-jdbc-3.42.0.0.jar
swagger-annotations/2.2.1//swagger-annotations-2.2.1.jar
swagger-core/2.2.1//swagger-core-2.2.1.jar
swagger-integration/2.2.1//swagger-integration-2.2.1.jar
swagger-jaxrs2/2.2.1//swagger-jaxrs2-2.2.1.jar
swagger-models/2.2.1//swagger-models-2.2.1.jar
swagger-ui/4.9.1//swagger-ui-4.9.1.jar
trino-client/363//trino-client-363.jar
units/1.6//units-1.6.jar
vertx-core/4.3.2//vertx-core-4.3.2.jar
vertx-grpc/4.3.2//vertx-grpc-4.3.2.jar
zjsonpatch/0.3.0//zjsonpatch-0.3.0.jar
zstd-jni/1.5.2-1//zstd-jni-1.5.2-1.jar
Reference in New Issue View Git Blame Copy Permalink