Skip to content

Conversation

@Alexander01998
Copy link

@Alexander01998 Alexander01998 commented Jun 23, 2024

The currently used SnakeYAML v1.27 has multiple security vulnerabilities. Specifically:
CVE-2022-1471
CVE-2022-25857
CVE-2022-41854
CVE-2022-38750
CVE-2022-38751
CVE-2022-38749
CVE-2022-38752

This PR updates SnakeYAML to v2.2, which is currently the latest version. Alternatively, updating to v2.0 or v2.1 would also resolve all of the vulnerabilities.

I did not find any compatibility issues with the update, but I'm also not that familiar with SnakeYAML or with your codebase, so I might have missed something. Apologies if applying this update is not feasible.

The previously used v1.27 has multiple security vulnerabilities. Specifically:
CVE-2022-1471
CVE-2022-25857
CVE-2022-41854
CVE-2022-38750
CVE-2022-38751
CVE-2022-38749
CVE-2022-38752

This update fixes all of them.
@NGSpace
Copy link

NGSpace commented Jul 4, 2025

No update on this?

@Alexander01998
Copy link
Author

Oh, hi again @NGSpace. I assume you got the same Dependabot warnings that I did? 😅

Here is what I added to my build.gradle to resolve the issue:

dependencies {
	constraints {
		modApi("org.yaml:snakeyaml:2.2") {
			because "version 1.27 pulled from cloth-config has security vulnerabilities"
		}
		modApi("com.google.code.gson:gson:2.11.0") {
			because "version 2.8.1 pulled from cloth-config has security vulnerabilities"
		}
	}
}

Another option is to fork Cloth Config and just change those two versions.

@NGSpace
Copy link

NGSpace commented Jul 4, 2025

Thanks, it's disappointing this hasn't been merged yet...

I will probably go my own route in my mod when it comes to the config cause I want some things that cloth config doesn't even support anyways but for now I need it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants