Update PyYAML (CVE-2017-18342)

[ramnes]

No description provided.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ramnes
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: lavalamp

If they are not already assigned, you can assign the PR to them by writing /assign @lavalamp in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[micw523]

We should not request a beta version for a production repo like this. Also, version 4.1 already fixed the problem.

[micw523]

See comment

[micw523]

Suggested change

	pyyaml>=4.2b1 # MIT
	pyyaml>=4.1 # MIT

[ramnes]

@micw523 PyYAML 4.1 doesn't exist on PyPI, they published it and then removed it. No version under 4.2b1 fixes this CVE. If we don't want to take the risk to upgrade to one of the beta versions, another solution is to replace all the yaml.load with yaml.safe_load. But this will have to be reverted when upgrading to 4.2.

Also, I'm realizing that since it's a beta, the version number must be pinned if we want the dependency to be pulled, and not marked as >=. I'm also realizing that a 4.2b4 exists. So I'd be in favor of doing pyyaml==4.2b4. But you tell me!

[micw523]

@ramnes
Thanks! I just realized that PyYaml 4.1 is indeed pulled from PyPI. However, kubernetes-client/python-base#111 just got merged. The yaml load has been replaced by safe_load in the python-base repo. Now the old versions of PyYAML should be fine as well.

Also, in new versions of PyYAML, calling safe_load has not been depreciated; instead it has been set as an equivalent fucntion of load. See https://github.com/yaml/pyyaml/blob/master/lib/yaml/__init__.py#L77. Therefore we don't need to revert the code if someone is using PyYAML 4.2 or higher when it is released.

Therefore, I think we can safely close the PR - what do you think?

[ramnes]

Oh, I didn't see that other PR on python-base, nice!

There are still some yaml.load lying around here though, including one in utils which I guess might be dangerous. I'll close this PR and open a new one to replace the unsafe calls by precaution, if you don't mind.