From: jitendra007 <jitendra.sharma1@huawei.com>
Date: Fri, 21 Aug 2020 05:34:56 +0000 (+0530)
Subject: Fix snakeyaml vulnerability
X-Git-Tag: 1.6.0~17
X-Git-Url: https://gerrit.onap.org/r/gitweb?a=commitdiff_plain;h=refs%2Fchanges%2F00%2F111500%2F3;p=vnfsdk%2Frefrepo.git

Fix snakeyaml vulnerability

Issue-ID: VNFSDK-584

Signed-off-by: jitendra007 <jitendra.sharma1@huawei.com>
Change-Id: Id132227aa3392fb55cd1ea357b07cb29b91a33e4
---

diff --git a/vnfmarket-be/vnf-sdk-marketplace/pom.xml b/vnfmarket-be/vnf-sdk-marketplace/pom.xml
index 41139fb3..5d68fd40 100644
--- a/vnfmarket-be/vnf-sdk-marketplace/pom.xml
+++ b/vnfmarket-be/vnf-sdk-marketplace/pom.xml
@@ -104,8 +104,28 @@
                     <groupId>com.fasterxml.jackson.core</groupId>
                     <artifactId>jackson-databind</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>com.fasterxml.jackson.dataformat</groupId>
+                    <artifactId>jackson-dataformat-yaml</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.dataformat</groupId>
+            <artifactId>jackson-dataformat-yaml</artifactId>
+            <version>2.9.5</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.yaml</groupId>
+                    <artifactId>snakeyaml</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
+        <dependency>
+            <groupId>org.yaml</groupId>
+            <artifactId>snakeyaml</artifactId>
+            <version>1.26</version>
+        </dependency>
         <!-- jersey -->
 <!-- excluded jetty-util and added invulnerable version -->
         <dependency>