Bug 237501

Summary: devel/py-yaml: Update to 5.1
Product: Ports & Packages Reporter: Sergey Akhmatov <sergey>
Component: Individual Port(s)Assignee: Josh Paetzel <jpaetzel>
Status: Closed FIXED    
Severity: Affects Many People CC: amontalban, jpaetzel, ports-secteam, python
Priority: Normal Keywords: security
Version: LatestFlags: koobs: maintainer-feedback+
koobs: merge-quarterly+
Hardware: Any   
OS: Any   
URL: https://github.com/yaml/pyyaml/blob/5.1/announcement.msg
See Also: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=241576
Bug Depends on:    
Bug Blocks: 237502    
Attachments:
Description Flags
py-yaml-5.1.patch
sergey: maintainer-approval? (jpaetzel)
vuxml for CVE-2017-18342 in py-yaml sergey: maintainer-approval? (jpaetzel)

Description Sergey Akhmatov 2019-04-23 16:42:51 UTC 
Created attachment 203934 [details]
py-yaml-5.1.patch

Update devel/py-yaml to 5.1

ChangeLog: https://github.com/yaml/pyyaml/blob/5.1/announcement.msg
Fixed CVE: https://nvd.nist.gov/vuln/detail/CVE-2017-18342

QA:
poudriere testport: OK on 11.2, 12.0 with all flavors
runtest some ansible-playbooks
Comment 1 Sergey Akhmatov 2019-04-23 16:44:30 UTC 
Created attachment 203935 [details]
vuxml for CVE-2017-18342 in py-yaml
Comment 2 Josh Paetzel freebsd_committer freebsd_triage 2019-04-24 14:47:58 UTC 
Approved
Comment 3 commit-hook freebsd_committer freebsd_triage 2019-04-24 15:31:39 UTC 
A commit references this bug:

Author: jpaetzel
Date: Wed Apr 24 15:30:41 UTC 2019
New revision: 499855
URL: https://svnweb.freebsd.org/changeset/ports/499855

Log:
  Document py-yaml vulnerability

  PR:	237501
  Submitted by:	sergey@akhmatov.ru
  Security:	CVE-2017-18342

Changes:
  head/security/vuxml/vuln.xml
Comment 4 commit-hook freebsd_committer freebsd_triage 2019-04-24 15:34:45 UTC 
A commit references this bug:

Author: jpaetzel
Date: Wed Apr 24 15:33:51 UTC 2019
New revision: 499857
URL: https://svnweb.freebsd.org/changeset/ports/499857

Log:
  Update to 5.1

  https://github.com/yaml/pyyaml/blob/5.1/announcement.msg

  =======================
   Announcing PyYAML-5.1
  =======================

  A new MAJOR RELEASE of PyYAML is now available:
  https://pypi.org/project/PyYAML/

  This is the first major release of PyYAML under the new maintenance team.

  Among the many changes listed below, this release specifically addresses the
  arbitrary code execution issue raised by:

      https://nvd.nist.gov/vuln/detail/CVE-2017-18342

  (See https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
  for complete details).
  ...

  PR:	237501
  Reported by:	sergey@akhmatov.ru

Changes:
  head/devel/py-yaml/Makefile
  head/devel/py-yaml/distinfo
Comment 5 Josh Paetzel freebsd_committer freebsd_triage 2019-04-24 15:36:21 UTC 
Committed, thanks!
Comment 6 Andres Montalban 2019-05-21 16:28:31 UTC 
Hi,

This package was upgraded but was not proposed for MFH so I cannot upgrade.

Should I open another bug for secteam?

Thanks!
Comment 7 Josh Paetzel freebsd_committer freebsd_triage 2019-05-21 17:00:13 UTC 
No, I'll get it merged.
Comment 8 Kubilay Kocak freebsd_committer freebsd_triage 2019-05-22 03:43:25 UTC 
Re-open pending MFH
Comment 9 commit-hook freebsd_committer freebsd_triage 2019-05-29 15:12:03 UTC 
A commit references this bug:

Author: jpaetzel
Date: Wed May 29 15:11:11 UTC 2019
New revision: 502966
URL: https://svnweb.freebsd.org/changeset/ports/502966

Log:
  MFH: r499857

  Update to 5.1

  https://github.com/yaml/pyyaml/blob/5.1/announcement.msg

  =======================
   Announcing PyYAML-5.1
  =======================

  A new MAJOR RELEASE of PyYAML is now available:
  https://pypi.org/project/PyYAML/

  This is the first major release of PyYAML under the new maintenance team.

  Among the many changes listed below, this release specifically addresses the
  arbitrary code execution issue raised by:

      https://nvd.nist.gov/vuln/detail/CVE-2017-18342

  (See https://github.com/yaml/pyyaml/wiki/PyYAML-yaml.load(input)-Deprecation
  for complete details).
  ...

  PR:	237501
  Reported by:	sergey@akhmatov.ru

  Approved by:	ports-secteam (joneum)
  Security:	f6ea18bb-65b9-11e9-8b31-002590045d9c

Changes:
_U  branches/2019Q2/
  branches/2019Q2/devel/py-yaml/Makefile
  branches/2019Q2/devel/py-yaml/distinfo