Skip to content
This repository was archived by the owner on Jan 12, 2024. It is now read-only.

Conversation

@guenp
Copy link

@guenp guenp commented Jan 22, 2021

This PR reverts changes made in #794.
The mentioned PyYAML CVE-2020-14343 vulnerability was ostensibly resolved in recent version (5.4), see issue: yaml/pyyaml#420

@guenp
Copy link
Author

guenp commented Jan 22, 2021

Converting this back to Draft - it looks like pip install frontmatter still installs the old version of PyYAML:
Edit: I was installing the wrong package. python-frontmatter indeed seems to install the latest version of PyYAML.

$ pip install python-frontmatter
Collecting python-frontmatter
  Using cached python_frontmatter-0.5.0-py3-none-any.whl (8.4 kB)
Requirement already satisfied: six in /home/guen/anaconda3/envs/azurequantum2/lib/python3.7/site-packages (from python-frontmatter) (1.15.0)
Collecting PyYAML
  Using cached PyYAML-5.4.1-cp37-cp37m-manylinux1_x86_64.whl (636 kB)
Installing collected packages: PyYAML, python-frontmatter
Successfully installed PyYAML-5.4.1 python-frontmatter-0.5.0

@guenp guenp changed the title Reactivate Summarizer after PyYAML vulnerability was resolved in version 5.4 [DRAFT] Reactivate Summarizer after PyYAML vulnerability was resolved in version 5.4 Jan 22, 2021
@guenp guenp changed the title [DRAFT] Reactivate Summarizer after PyYAML vulnerability was resolved in version 5.4 Reactivate Summarizer after PyYAML vulnerability was resolved in version 5.4 Jan 22, 2021
@cgranade
Copy link
Contributor

Looks good to me. My only suggestion would be to perhaps pin pyyaml in requirements.txt to a specific known-good version, so that we don't get the old version installed by accident.

@guenp
Copy link
Author

guenp commented Jan 22, 2021

@cgranade thanks! Sure, happy to add that to requirements.txt; not sure if that will help though because the requirements are installed in no particular order so the pyyaml version might as well be overwritten later. But I'll add it as a note to ourselves which actual pyyaml version we need.

@guenp guenp merged commit 24fb8e8 into main Jan 23, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants