vulnerable dependency maven:org.yaml:snakeyaml

Question

I am periodically checking vulnerabilities on my pom.xml and generally fix these problems by updating the dependency versions. However, I get the following error:

Provides transitive vulnerable dependency maven:org.yaml:snakeyaml:1.30 CVE-2022-25857 7.5 Uncontrolled Resource Consumption vulnerability pending CVSS allocation CVE-2022-38752 6.5 Out-of-bounds Write vulnerability with medium severity found CVE-2022-38749 6.5 Out-of-bounds Write vulnerability pending CVSS allocation CVE-2022-38750 5.5 Out-of-bounds Write vulnerability pending CVSS allocation CVE-2022-38751 6.5 Out-of-bounds Write vulnerability pending CVSS allocation CVE-2022-41854 6.5 Stack-based Buffer Overflow vulnerability with medium severity found CVE-2022-1471 9.8 Deserialization of Untrusted Data vulnerability with high severity found
Results powered by Checkmarx(c)

I I try to add <version> to the <artifactId>spring-boot-starter-web</artifactId> in my pom.xml, but it does not make any sense.

So, how can I fix this problem properly? I use IntelliJ default features to fix this kind of problems, but should I do any an extra useful plugins etc.?

Answer 1

Unfortunately, Spring Boot 2.7.x still uses an older, vulnerable version of SnakeYAML (1.30). They still have not upgraded it to the last version (1.33). Spring Boot 3.0.0 does depend on version 1.33.

Assuming you cannot upgrade to Spring Boot 3.0.0 yet, the only thing that should work is to add a dependency to SnakeYAML 1.33 in your project. That version should then take precedence over Spring Boot's transitive dependency.

However, SnakeYAML 1.33 still has a vulnerability. Since that is the last version (SnakeYAML 2.x is not compatible with 1.x), that's something you can't get rid off until the SnakeYAML team fixes that.

Edit: with SnakeYAML 2.x, I meant this one. SnakeYAML 1.33 recently had a follow-up 2.0 version which is a different one. Compatibility between 1.33 and 2.0 is still not 100%, but Spring Boot 2.7.10+ and Spring Boot 3.x should support both.

Answer 2

SnakeYAML 2.2 version is compatible with SpringBoot 3.1.3.

<dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.yaml</groupId>
        <artifactId>snakeyaml</artifactId>
        <version>2.2</version>
    </dependency>

Copy and paste in your pom.xml and re-run your application.

Answer 3

Rob Spoor has already explained why, this warning can be eliminated by excluding dependencies:

<exclusions>
    <exclusion>
        <groupId>org.yaml</groupId>
        <artifactId>snakeyaml</artifactId>
    </exclusion>
</exclusions>

Add the above code to the corresponding <dependency> label.

Answer 4

I had the same warning in Springboot 3.0.6. It was working properly but it annoyed me a lot to see a huge yellow piece of code in pom.xml. I overcome this issue by adding exclusions to the code as was mentioned above.

Code with the warning:

<dependency>
  <artifactId>spring-boot-starter-data-mongodb</artifactId>
  <groupId>org.springframework.boot</groupId>
</dependency>

This is the working solution:

<dependency>
  <artifactId>spring-boot-starter-data-mongodb</artifactId>
  <groupId>org.springframework.boot</groupId>
  <exclusions>
    <exclusion>
      <artifactId>snakeyaml</artifactId>
      <groupId>org.yaml</groupId>
    </exclusion>
  </exclusions>
</dependency>

Answer 5

You need to update the SnakeYAML version to 2.0. To do this, add the below code in pom.xml and re-run your application.

<dependency>
    <groupId>org.yaml</groupId>
    <artifactId>snakeyaml</artifactId>
    <version>2.0</version>
</dependency>

Answer 6

When you have a maven setup, where spring-boot is your parent, you can also set the snakeyaml.version property to override its version:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>example.com</groupId>
    <artifactId>foo</artifactId>
    <version>1.13-SNAPSHOT</version>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.1.4</version>
        <relativePath />
    </parent>

    <properties>
        <snakeyaml.version>2.2</snakeyaml.version>
    </properties>
...