package/python-pyyaml: security bump to version 5.4.1
authorFabrice Fontaine <fontaine.fabrice@gmail.com>
Tue, 2 Mar 2021 17:25:23 +0000 (18:25 +0100)
committerYann E. MORIN <yann.morin.1998@free.fr>
Tue, 2 Mar 2021 20:49:10 +0000 (21:49 +0100)
commitde43a9775d4646035b18eb5737e5fa4cd2eeedea
tree82c5d181eb2e88a7989bc182a37247db97923bcb
parent6b714a9c3b1b14526bffdb1319ab1bfaaba45732
package/python-pyyaml: security bump to version 5.4.1

Fix CVE-2020-14343: A vulnerability was discovered in the PyYAML library
in versions before 5.4, where it is susceptible to arbitrary code
execution when it processes untrusted YAML files through the full_load
method or with the FullLoader loader. Applications that use the library
to process untrusted input may be vulnerable to this flaw. This flaw
allows an attacker to execute arbitrary code on the system by abusing
the python/object/new constructor. This flaw is due to an incomplete fix
for CVE-2020-1747.

Update hash of LICENSE file (update in year:
https://github.com/yaml/pyyaml/commit/58d0cb7ee09954c67fabfbd714c5673b03e7a9e1)

https://github.com/yaml/pyyaml/blob/5.4.1/CHANGES

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
package/python-pyyaml/python-pyyaml.hash
package/python-pyyaml/python-pyyaml.mk
package/python3-pyyaml/python3-pyyaml.mk