Repository: zbrookle/avionix (language: python)

Issue:
PyYAML version required by Avionix has critical security vulnerability (CVE-2020-14343)
Avionix currently [requires](https://github.com/zbrookle/avionix/blob/4cf13fbd520b16870ff6090846242a6747b50bcc/setup.py#L31) `pyyaml >=5.3, <5.4`, but PyYAML versions prior to 5.4 are susceptible to the critical security vulnerability described in [CVE-2020-14343](https://nvd.nist.gov/vuln/detail/CVE-2020-14343).

---

Note: There was originally [CVE-2020-1747](https://nvd.nist.gov/vuln/detail/CVE-2020-1747), but the fix in PyYAML 5.3.1 was incorrect/incomplete.


Discussion / hints:
@cicconej Thanks for the heads up, I'm surprised dependabot didn't catch that, it will usually notify about things of that nature

Fix patch:
diff --git a/requirements.txt b/requirements.txt
index e4cf41e..386572c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,1 +1,1 @@
-pyyaml==5.3.1
\ No newline at end of file
+pyyaml>=5.4
\ No newline at end of file
diff --git a/setup.py b/setup.py
index 50ce768..370fd97 100644
--- a/setup.py
+++ b/setup.py
@@ -28,7 +28,7 @@ def read_file(filename):
     description="A package for soldifying kubernetes structure and development by "
     "using objects and code rather than yaml",
     python_requires=">=3.6.1",
-    install_requires=["pyyaml >=5.3, <5.4"],
+    install_requires=["pyyaml >=5.4"],
     project_urls={
         "Source Code": "https://github.com/zbrookle/avionix",
         "Documentation": "https://github.com/zbrookle/avionix",


Test patch:
diff --git a/avionix/tests/test_values_yaml.py b/avionix/tests/test_values_yaml.py
index 981397d..d1b69a3 100644
--- a/avionix/tests/test_values_yaml.py
+++ b/avionix/tests/test_values_yaml.py
@@ -57,7 +57,7 @@ def get_config_map_data():
     if not match:
         raise Exception("Match must exist to get config map data!")
     data_string = match.group("data").replace("----\n", "").replace(":\n", ": ")
-    data = yaml.load(data_string)
+    data = yaml.safe_load(data_string)
     return data