https://bugzilla.redhat.com/show_bug.cgi?id=1785376
--- Comment #5 from Marco Benatto mbenatto@redhat.com --- Statement:
The snakeyaml's upstream is not considering this a security vulnerability. Their justification is explained on the link contained on 'External References' field.