CVE-2020-14343.patch

@@ -0,0 +1,124 @@
+From 7adc0db3f613a82669f2b168edd98379b83adb3c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ingy=20d=C3=B6t=20Net?= <ingy@ingy.net>
+Date: Sat, 9 Jan 2021 10:53:23 -0500
+Subject: [PATCH] Fix for CVE-2020-14343
+
+Per suggestion https://github.com/yaml/pyyaml/issues/420#issuecomment-663888344
+move a few constructors from full_load to unsafe_load.
+---
+ lib/yaml/constructor.py      | 24 ++++++++++++------------
+ lib3/yaml/constructor.py     | 24 ++++++++++++------------
+ tests/lib/test_recursive.py  |  2 +-
+ tests/lib3/test_recursive.py |  2 +-
+ 4 files changed, 26 insertions(+), 26 deletions(-)
+
+diff --git a/lib/yaml/constructor.py b/lib/yaml/constructor.py
+index 794681cb..c42ee344 100644
+--- a/lib/yaml/constructor.py
++++ b/lib/yaml/constructor.py
+@@ -722,18 +722,6 @@ def construct_python_object_new(self, suffix, node):
+     u'tag:yaml.org,2002:python/name:',
+     FullConstructor.construct_python_name)
+ 
+-FullConstructor.add_multi_constructor(
+-    u'tag:yaml.org,2002:python/module:',
+-    FullConstructor.construct_python_module)
+-
+-FullConstructor.add_multi_constructor(
+-    u'tag:yaml.org,2002:python/object:',
+-    FullConstructor.construct_python_object)
+-
+-FullConstructor.add_multi_constructor(
+-    u'tag:yaml.org,2002:python/object/new:',
+-    FullConstructor.construct_python_object_new)
+-
+ class UnsafeConstructor(FullConstructor):
+ 
+     def find_python_module(self, name, mark):
+@@ -750,6 +738,18 @@ def set_python_instance_state(self, instance, state):
+         return super(UnsafeConstructor, self).set_python_instance_state(
+             instance, state, unsafe=True)
+ 
++UnsafeConstructor.add_multi_constructor(
++    u'tag:yaml.org,2002:python/module:',
++    UnsafeConstructor.construct_python_module)
++
++UnsafeConstructor.add_multi_constructor(
++    u'tag:yaml.org,2002:python/object:',
++    UnsafeConstructor.construct_python_object)
++
++UnsafeConstructor.add_multi_constructor(
++    u'tag:yaml.org,2002:python/object/new:',
++    UnsafeConstructor.construct_python_object_new)
++
+ UnsafeConstructor.add_multi_constructor(
+     u'tag:yaml.org,2002:python/object/apply:',
+     UnsafeConstructor.construct_python_object_apply)
+diff --git a/lib3/yaml/constructor.py b/lib3/yaml/constructor.py
+index 1948b125..619acd30 100644
+--- a/lib3/yaml/constructor.py
++++ b/lib3/yaml/constructor.py
+@@ -710,18 +710,6 @@ def construct_python_object_new(self, suffix, node):
+     'tag:yaml.org,2002:python/name:',
+     FullConstructor.construct_python_name)
+ 
+-FullConstructor.add_multi_constructor(
+-    'tag:yaml.org,2002:python/module:',
+-    FullConstructor.construct_python_module)
+-
+-FullConstructor.add_multi_constructor(
+-    'tag:yaml.org,2002:python/object:',
+-    FullConstructor.construct_python_object)
+-
+-FullConstructor.add_multi_constructor(
+-    'tag:yaml.org,2002:python/object/new:',
+-    FullConstructor.construct_python_object_new)
+-
+ class UnsafeConstructor(FullConstructor):
+ 
+     def find_python_module(self, name, mark):
+@@ -738,6 +726,18 @@ def set_python_instance_state(self, instance, state):
+         return super(UnsafeConstructor, self).set_python_instance_state(
+             instance, state, unsafe=True)
+ 
++UnsafeConstructor.add_multi_constructor(
++    'tag:yaml.org,2002:python/module:',
++    UnsafeConstructor.construct_python_module)
++
++UnsafeConstructor.add_multi_constructor(
++    'tag:yaml.org,2002:python/object:',
++    UnsafeConstructor.construct_python_object)
++
++UnsafeConstructor.add_multi_constructor(
++    'tag:yaml.org,2002:python/object/new:',
++    UnsafeConstructor.construct_python_object_new)
++
+ UnsafeConstructor.add_multi_constructor(
+     'tag:yaml.org,2002:python/object/apply:',
+     UnsafeConstructor.construct_python_object_apply)
+diff --git a/tests/lib/test_recursive.py b/tests/lib/test_recursive.py
+index 312204ea..04c57985 100644
+--- a/tests/lib/test_recursive.py
++++ b/tests/lib/test_recursive.py
+@@ -30,7 +30,7 @@ def test_recursive(recursive_filename, verbose=False):
+     output2 = None
+     try:
+         output1 = yaml.dump(value1)
+-        value2 = yaml.load(output1, yaml.FullLoader)
++        value2 = yaml.load(output1, yaml.UnsafeLoader)
+         output2 = yaml.dump(value2)
+         assert output1 == output2, (output1, output2)
+     finally:
+diff --git a/tests/lib3/test_recursive.py b/tests/lib3/test_recursive.py
+index 74c2ee65..08042c81 100644
+--- a/tests/lib3/test_recursive.py
++++ b/tests/lib3/test_recursive.py
+@@ -31,7 +31,7 @@ def test_recursive(recursive_filename, verbose=False):
+     output2 = None
+     try:
+         output1 = yaml.dump(value1)
+-        value2 = yaml.full_load(output1)
++        value2 = yaml.unsafe_load(output1)
+         output2 = yaml.dump(value2)
+         assert output1 == output2, (output1, output2)
+     finally:

Fix-build-Error-due-to-cython-updated.patch

@@ -1,29 +0,0 @@
-From 293a0cead0d90fb19cbfa0e4138f0b3886414b92 Mon Sep 17 00:00:00 2001
-From: "Andrew J. Hesford" <ajh@sideband.org>
-Date: Wed, 31 Jan 2024 09:57:35 +0800
-Subject: [PATCH] fix build Error due to cython updated
-
----
- setup.py | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/setup.py b/setup.py
-index 65b0ea0..4461580 100644
---- a/setup.py
-+++ b/setup.py
-@@ -82,7 +82,11 @@ if 'sdist' in sys.argv or os.environ.get('PYYAML_FORCE_CYTHON') == '1':
-     with_cython = True
- try:
-     from Cython.Distutils.extension import Extension as _Extension
--    from Cython.Distutils import build_ext as _build_ext
-+    try:
-+        from Cython.Distutils.old_build_ext import old_build_ext as _build_ext
-+    except ImportError:
-+        from Cython.Distutils import build_ext as _build_ext
-+
-     with_cython = True
- except ImportError:
-     if with_cython:
--- 
-2.33.0
-

PyYAML.spec

@@ -1,14 +1,14 @@
 %bcond_without python2
 %bcond_without python3
 
-Name:           pyYAML
-Version:        6.0.1
-Release:        2
+Name:           pyyaml
+Version:        5.3.1
+Release:        4
 Summary:        YAML parser and emitter for Python
 License:        MIT
 URL:            https://github.com/yaml/pyyaml
-Source0:        https://files.pythonhosted.org/packages/source/P/PyYAML/PyYAML-%{version}.tar.gz
-Patch0:         Fix-build-Error-due-to-cython-updated.patch
+Source0:        https://github.com/yaml/pyyaml/archive/%{version}.tar.gz
+Patch0000:	CVE-2020-14343.patch	
 
 BuildRequires:  gcc libyaml-devel
 
@@ -56,8 +56,8 @@ files to object serialization and persistence.
 %endif
 
 %prep
-%setup -q -n PyYAML-%{version}
-%patch0 -p1
+%setup -q -n %{name}-%{version}
+%patch0000 -p1
 
 %build
 %if %{with python3}
@@ -78,26 +78,11 @@ files to object serialization and persistence.
 %if %{with python3}
 %files -n python3-pyyaml
 %license LICENSE
-%doc CHANGES examples
+%doc CHANGES README examples
 %{python3_sitearch}/*
 %endif
 
 %changelog
-* Wed Jan 31 2024 Ge Wang <wang__ge@126.com> - 6.0.1-2
-- fix build error due to cython updated
-
-* Wed Jul 26 2023 sunhui <sunhui@kylinos.cn> - 6.0.1-1
-- Update package to version 6.0.1
-
-* Wed Oct 26 2022 zhuofeng <zhuofeng2@huawei.com> - 6.0-2
-- rebuild for next release
-
-* Fri Dec 24 2021 tianwei <tianwei12@huawei.com> - 6.0-1
-- Upgrade to 6.0
-
-* Tue Jul 13 2021 huangtianhua <huangtianhua@huawei.com> - 5.4.1-1
-- Upgrade to 5.4.1
-
 * Fri Jun 11 2021 zhaomengchao <zhaomengchao3@huawei.com> - 5.3.1-4
 * Fix CVE-2020-14343