I'm using the Azure-CLI package in a Python project I'm building at work and when I put that project through a pipeline that includes a package scanner, it's coming up with a critical vulnerability linking back to to PyYAML/5.3.1, which is being pulled into my project through Knack/0.9.0.
Dependency Tree:
azure-cli/2.36.0
-> azure-cli-core/2.36.0
-> knack/0.9.0
-> PyYAML 5.3.1
I know the CVE states versions before 5.3.1 but our scanner says that PyYAML 5.3.1 still poses a high security risk "due to an incomplete fix for CVE-2020-1747, BDSA-2020-0504."
Looking at the requirements.txt file for Knack, it looks like PyYAML is the only package listed without a specified point release. Cross referencing that with the release history of PyYAML on PyPi.org it seems like Knack was pulling a version of PyYAML (5.3.1) that's over two years old, when there have been 5.4, 5.4.1, and 6.0 versions released since then.
The latest version of Knack on PyPi.org was released on November 05, 2021 - so I'm not sure why Pip didn't grab the latest major release of PyYAML... but it seems like it is.
Any chance y'all can update Knack to use a newer version of PyYAML so that downstream Azure packages aren't being flagged for arbitrary code execution?
I'm using the Azure-CLI package in a Python project I'm building at work and when I put that project through a pipeline that includes a package scanner, it's coming up with a critical vulnerability linking back to to
PyYAML/5.3.1, which is being pulled into my project throughKnack/0.9.0.Dependency Tree:
I know the CVE states
versions before 5.3.1but our scanner says thatPyYAML 5.3.1still poses a high security risk "due to an incomplete fix for CVE-2020-1747, BDSA-2020-0504."Looking at the requirements.txt file for Knack, it looks like
PyYAMLis the only package listed without a specified point release. Cross referencing that with the release history of PyYAML on PyPi.org it seems like Knack was pulling a version of PyYAML (5.3.1) that's over two years old, when there have been5.4,5.4.1, and6.0versions released since then.The latest version of Knack on PyPi.org was released on November 05, 2021 - so I'm not sure why Pip didn't grab the latest major release of PyYAML... but it seems like it is.
Any chance y'all can update Knack to use a newer version of PyYAML so that downstream Azure packages aren't being flagged for arbitrary code execution?