Update announcement.msg
diff --git a/CHANGES b/CHANGES
index e74edc2..f3facb1 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,10 @@
* https://github.com/yaml/pyyaml/commits/
* https://bitbucket.org/xi/pyyaml/commits/
+5.3.1 (2020-03-18)
+
+* https://github.com/yaml/pyyaml/pull/386 -- Prevents arbitrary code execution during python/object/new constructor
+
5.3 (2020-01-06)
* https://github.com/yaml/pyyaml/pull/290 -- Use `is` instead of equality for comparing with `None`
diff --git a/LICENSE b/LICENSE
index e8f8805..3d82c28 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2017-2019 Ingy döt Net
+Copyright (c) 2017-2020 Ingy döt Net
Copyright (c) 2006-2016 Kirill Simonov
Permission is hereby granted, free of charge, to any person obtaining a copy of
diff --git a/announcement.msg b/announcement.msg
index c52ecd5..1c0bcdd 100644
--- a/announcement.msg
+++ b/announcement.msg
@@ -1,36 +1,25 @@
From: Tina Müller <post@tinita.de>
To: python-list@python.org, python-announce@python.org, yaml-core@lists.sourceforge.net
-Subject: [ANN] PyYAML-5.3: YAML parser and emitter for Python
+Subject: [ANN] PyYAML-5.3.1: YAML parser and emitter for Python
=======================
-Announcing PyYAML-5.3
+Announcing PyYAML-5.3.1
=======================
A new release of PyYAML is now available:
https://pypi.org/project/PyYAML/
-This release contains some bugfixes (handling of slots, enable unicode for
-maxunicode < 0xffff, enable large files), enhancements (create timezone
-aware datetimes) and some other small enhancements.
+This release contains a security fix for CVE-2020-1747. FullLoader was still
+exploitable for arbitrary command execution.
+https://bugzilla.redhat.com/show_bug.cgi?id=1807367
+
+Thanks to Riccardo Schirone (https://github.com/ret2libc) for both reporting
+this and providing the fixes to resolve it.
Changes
=======
-* https://github.com/yaml/pyyaml/pull/290 -- Use `is` instead of equality for comparing with `None`
-* https://github.com/yaml/pyyaml/pull/270 -- fix typos and stylistic nit
-* https://github.com/yaml/pyyaml/pull/309 -- Fix up small typo
-* https://github.com/yaml/pyyaml/pull/161 -- Fix handling of __slots__
-* https://github.com/yaml/pyyaml/pull/358 -- Allow calling add_multi_constructor with None
-* https://github.com/yaml/pyyaml/pull/285 -- Add use of safe_load() function in README
-* https://github.com/yaml/pyyaml/pull/351 -- Fix reader for Unicode code points over 0xFFFF
-* https://github.com/yaml/pyyaml/pull/360 -- Enable certain unicode tests when maxunicode not > 0xffff
-* https://github.com/yaml/pyyaml/pull/359 -- Use full_load in yaml-highlight example
-* https://github.com/yaml/pyyaml/pull/244 -- Document that PyYAML is implemented with Cython
-* https://github.com/yaml/pyyaml/pull/329 -- Fix for Python 3.10
-* https://github.com/yaml/pyyaml/pull/310 -- increase size of index, line, and column fields
-* https://github.com/yaml/pyyaml/pull/260 -- remove some unused imports
-* https://github.com/yaml/pyyaml/pull/163 -- Create timezone-aware datetimes when parsed as such
-* https://github.com/yaml/pyyaml/pull/363 -- Add tests for timezone
+* https://github.com/yaml/pyyaml/pull/386 -- Prevents arbitrary code execution during python/object/new constructor
Resources
@@ -90,8 +79,8 @@
The following people are currently responsible for maintaining PyYAML:
-* Ingy döt Net
* Tina Mueller
+* Ingy döt Net
* Matt Davis
and many thanks to all who have contribributed!
@@ -101,7 +90,7 @@
Copyright
=========
-Copyright (c) 2017-2019 Ingy döt Net <ingy@ingy.net>
+Copyright (c) 2017-2020 Ingy döt Net <ingy@ingy.net>
Copyright (c) 2006-2016 Kirill Simonov <xi@resolvent.net>
The PyYAML module was written by Kirill Simonov <xi@resolvent.net>.
