CVE-2022-1471 suggest to use using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization.

[wanghliu]

Describe the bug
CVE-2022-1471 suggest to use using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. Could you please confirm if client-java 16.0.0 all used SnakeYaml's SafeConsturctor? if there is any impact by CVE-2022-1471 ?

Client Version
client-java is 16.0.0, dependency snakeyaml version 1.32

Kubernetes Version
e.g. 1.19.3

Java Version
e.g. Java 8

To Reproduce
Steps to reproduce the behavior:

Expected behavior
A clear and concise description of what you expected to happen.

KubeConfig
If applicable, add a KubeConfig file with secrets redacted.

Server (please complete the following information):

• OS: [e.g. Linux]
• Environment [e.g. container]
• Cloud [e.g. Azure]

Additional context
Add any other context about the problem here.

[yupitomets]

would be better to upgrade snakeyaml to 2.0 version instead? This version has vulnerability fixed.

[wanghliu]

@yupitomets Thanks for your reply. We will upgrade snakeyaml in our future version, but it does not release yet and needs more times to release.
From description in https://nvd.nist.gov/vuln/detail/CVE-2022-1471, it suggested to use SafeConsturctor, it do not be impacted if use SafeConsturctor.
I searched "snakeyaml.constructor" in this git repo, only Yaml.java imported Constructor and BaseConstructor, the line is https://github.com/kubernetes-client/java/blob/master/util/src/main/java/io/kubernetes/client/util/Yaml.java#L45.
Could you please confirm if client-java 16.0.0 are all used snakeyaml with SafeConsturctor ? If not, which class or function will be impacted?

[brendandburns]

16.0.3 has a fix to always use Safe Constructor. 16.0.[2,1,0] do not.

https://github.com/kubernetes-client/java/commits/automated-release-16.0.3

If you are worried about this CVE please upgrade to 16.0.3

Alternatively, a switch to SnakeYAML 2.0 has merged for the 17.x branch and we will cut a new release soon:
#2612