Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

osv reports pyyaml needs upgrade when it is already upgraded

See original GitHub issue

Hello, I can’t tell is this is because osv is corrupt and y’all can’t do anything about it or if pip-audit can’t do version number comparisons. I’m still learning, but I can’t find a way to skip this.

It only takes one unresolvable false positive and I have to disable a tool like this from the build server. safety has a --ignore switch, does pip-audit have one?

$ pip-audit -s osv
Found 1 known vulnerabilities in 1 packages
Name   Version ID             Fix Versions
------ ------- -------------- ------------
pyyaml 5.4.1   PYSEC-2021-142 5.4

$ pip freeze | grep PyY
PyYAML==5.4.1

Issue Analytics

State:
Created 2 years ago
Comments:15 (12 by maintainers)

Top GitHub Comments

1reaction

dicommented, Dec 6, 2021

@matthewdeanmartin FYI, this should be fixed by https://github.com/google/osv/pull/273/.

0reactions

dicommented, Dec 4, 2021

There’s a YouTube video? 🙂

I had the same reaction, and then I remembered I gave a sneak peek of pip-audit in my PackagingCon talk: https://www.youtube.com/watch?v=PlGcg-MUtXk

Top Results From Across the Web

False Positive for Patched pyyaml From osv Source #69 - GitHub

This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an ......

How to upgrade disutils package PyYAML? - Stack Overflow

Try using the --ignore-installed flag: sudo -H pip3 install --ignore-installed PyYAML. This works because to upgrade a package, pip first ...

Improper Input Validation in PyYAML - Vulners

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes ......

PyYAML is a YAML parser and emitter for Python.

A simple extension API is provided. both pure-Python and fast LibYAML-based parsers and emitters. relatively sensible error messages. Requirements. PyYAML ...

homebrew-core - Homebrew Formulae

a2ps 4.14 Any‑to‑PostScript filter aacgain 1.8 AAC‑supporting version of mp3gain aalib 1.4rc5 Portable ASCII art graphics library aamath 0.3 Renders mathematical expressions as ASCII art