SnakeYAML vulnerability with latest Logstash version

Elastic Stack Logstash
1

Hi,
In the latest version of Logstash, SnakeYAML dependency was bumped to 1.33 but it seems that is vulnerable as well. The vulnerability CVE-2022-1471 is a critical one with score of 9.8.
Are there plans to bump it to 2.0 in next release?
Thanks

2

Please see Security issues | Elastic;

Users and customers may report any other potential security issues to security@elastic.co. This address can be used for product security related inquiries or requests about other security topics that are not explicitly mentioned here. We can accept only security issues at this address. Bug reports should be directed to the bug database of the project you're reporting it on or raised to Elastic Support.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.