Aws-cli: Please port to a newer version of PyYAML

[glaubitz]

The current upstream release of PyYAML is 5.1 while aws-cli still depends on PyYAML <= 3.13.

Would be nice if aws-cli could be ported to the latest version of PyYAML that version dependency could be raised to 5.1 or higher.

[kabbedijk]

The PR for this is already approved and waiting for merge.
https://github.com/aws/aws-cli/pull/4015#issuecomment-480319733

It is taking quite some time though :)

[glaubitz]

Thanks. I'll look into cherry-picking the patch for openSUSE later today then.

[justnance]

@glaubitz - Thanks for your post. I have updated our internal collaboration on this issue. We are tracking this work under #3660 and #2290. To avoid duplicate efforts I'm closing this issue.

[asottile]

@justnance neither of those issues are relevant to allowing a newer pyyaml, could you please reopen this and/or review the patch in #4015?

[SeppPenner]

The currently used [email protected] contains a Arbitrary Code Execution issue. Check https://app.snyk.io/vuln/SNYK-PYTHON-PYYAML-42159 and https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342 for more information. (Just as reference for the duplicate issue I added here: #4193).

[rigogsilva]

UP, UP, UP. please!!!

[justnance]

@asottile - Thanks for referencing #4015 and commenting in merged PR #4231. I'm looking into confirming this issue is resolve before closing. thanks.

[asottile]

For 5.1 this is done, but now there's a 5.1.1

After the last snub in my previous PR I'm not really inclined to try and fix this one

[justnance]

@asottile - Thanks again for the feedback. I've confirmed the behavior with PyYAML 5.1.1 under #4350 and labeled this issue as enhancement. We are working on getting fixed under PR #4355.

related to: #4350 #4243

[joguSD]

The version range has been updated, closing this out.