I think Knack is pulling a version of PyYAML that has a known vulnerability. #258
Assignees
Comments
|
@Quinncuatro, as you can see from the source code, Knack has no hard version dependency on PyYAML when installing from PyPI: Line 17 in b4d9e66 I would recommend checking which library is installing old version of PyYAML: |
|
Another possibility is you are using deprecated Python 3.5 which is only supported by PyYAML 5.3.1, but not by later versions like PyYAML 5.4. |
|
Sorry for the delay @jiasli - had a meeting with my manager and then ran some tests in my pipeline in Azure DevOps.
I was using regular I also ran that I'm going to run another test using |
|
Do you mind sharing the content of your |
|
Sure thing. And for the record, using
|
|
Notice this line:
I can reproduce with this ADO job: - job: TestPyYAML
pool:
vmImage: 'ubuntu-20.04'
steps:
- bash: |
python -V
pip -V
pip list
This means PyYAML 5.3.1 is actually installed by ADO agent. The root cause is because Ubuntu's repository only contains To solve it, you can add a - job: TestPyYAML
pool:
vmImage: 'ubuntu-20.04'
steps:
- task: UsePythonVersion@0
displayName: 'Use Python 3.8'
inputs:
versionSpec: 3.8
- bash: |
python -V
pip -V
pip listIt is also recommended to create a virtual environment and activate it: https://packaging.python.org/en/latest/guides/installing-using-pip-and-virtual-environments/#creating-a-virtual-environment Then the issue should be gone. |
|
I can also reproduce this issue on Ubuntu docker image: |
|
In summary, PyYAML 5.3.1 doesn't come from Knack's dependency, but comes from Ubuntu's According to the changelog of http://changelogs.ubuntu.com/changelogs/pool/main/p/pyyaml/pyyaml_5.3.1-1ubuntu0.1/changelog
Ubuntu developers can add security patches to their |
|
Huh, the Though I'm not entirely sure how it's working. Is that package doing something like I'll look into setting up a Virtual Environment for this to further protect myself from any weird bugs and talk to our security team about BlackDuck flagging something that technically has been fixed. Thank you so much for your help, though! I really don't think I would have been able to figure that one out on my own. |
Not really.
I am really glad I can be of help, even though this is not Knack or Azure CLI's problem. 😊 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I'm using the Azure-CLI package in a Python project I'm building at work and when I put that project through a pipeline that includes a package scanner, it's coming up with a critical vulnerability linking back to to
PyYAML/5.3.1, which is being pulled into my project throughKnack/0.9.0.Dependency Tree:
I know the CVE states
versions before 5.3.1but our scanner says thatPyYAML 5.3.1still poses a high security risk "due to an incomplete fix for CVE-2020-1747, BDSA-2020-0504."Looking at the requirements.txt file for Knack, it looks like
PyYAMLis the only package listed without a specified point release. Cross referencing that with the release history of PyYAML on PyPi.org it seems like Knack was pulling a version of PyYAML (5.3.1) that's over two years old, when there have been5.4,5.4.1, and6.0versions released since then.The latest version of Knack on PyPi.org was released on November 05, 2021 - so I'm not sure why Pip didn't grab the latest major release of PyYAML... but it seems like it is.
Any chance y'all can update Knack to use a newer version of PyYAML so that downstream Azure packages aren't being flagged for arbitrary code execution?
The text was updated successfully, but these errors were encountered: