Snake YAML 1.3 vulnerability

Support
#1

I was forced by devops to update to snake yaml 2.0 and im getting this error.
org.springframework.beans.factory.BeanCreationException: Error creating bean with name ‘jmix_Liquibase’ defined in class path resource [io/jmix/autoconfigure/data/JmixLiquibaseAutoConfiguration.class]: Invocation of init method failed; nested exception is java.lang.NoSuchMethodError: org.yaml.snakeyaml.constructor.SafeConstructor: method ‘void ()’ not found

my version
plugins {
id ‘io.jmix’ version ‘1.5.2’
id ‘java’
}

apply plugin: ‘org.springframework.boot’

jmix {
bomVersion = ‘1.5.2’
projectId = ‘apt’
}

Help please, I cannot put this into production because of this and I have a meeting next week to present my project. And need to show this to the project manager tomorrow.

Resolving CVE-2022-1471  with the SnakeYAML 2.0 Release | Veracode.

Is jmix repo scanned by something like sysdig its been more than one time that ive had problems with CVEs and this one has really become a showstopper.

1 Like
#3

Hi Eduardo,

I’ve just created a new Jmix project with 1.5.2 version and raised the snakeyaml version there:

implementation 'org.yaml:snakeyaml:2.0'

The project started without any problem. Try creating a new project and raising the version on your side. Do you get the error?