CVE-2019-20477

Advisory

Pulumi-kubernetes 2.6.0 updates its dependency 'pyyaml' minimum version to v5.3.1 to include security fixes.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Note: There is a minor breaking change in the .NET SDK for Helm v3. As part of the switch to using native
Helm libraries in 1291, the Helm.V3.Chart class no longer inherits from the ChartBase class. Most users should
not be affected by this change.

Bug Fixes

- Upgrade version of pyyaml to fix a [security vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2019-20477) (https://github.com/pulumi/pulumi-kubernetes/pull/1230)
- Fix Helm api-versions handling in all SDKs. (https://github.com/pulumi/pulumi-kubernetes/pull/1307)

Improvements

- Update .NET Helm v3 to use native client. (https://github.com/pulumi/pulumi-kubernetes/pull/1291)
- Update Go Helm v3 to use native client. (https://github.com/pulumi/pulumi-kubernetes/pull/1296)
- Python: Allow type annotations on transformation functions. (https://github.com/pulumi/pulumi-kubernetes/pull/1298)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20477