security: CVE-2017-18640 with org.yaml : snakeyaml : 1.17

[ghost]

One of our transitive dependencies with snakeyaml is causing a new alert/security blocker for builds.
The CVE abstract states the developer of the package will not fix the issue.
The issue is related to programmatically consuming YML with "malicious" dependencies causing memory outages, which falls way beyond our limited usage of static yml resources for Spring configuration.

Therefore, the issue should be waived with a small description of how our usage does not make Vorto vulnerable.

@kolotu could you please assign to @t-gauss , as he's the only one able to waive at this time?

Note: this is a blocker for processing pull requests at this time.

[kolotu]

I can't assign to @t-gauss for some reason. He doesn't show up in the list.

[t-gauss]

Waived it.

[ghost]

Thanks @t-gauss