CVE-2022-42969

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 32%
Affected Products (NVD)
VendorProductVersion
pytestpy
𝑥
≤ 1.11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-py
bookworm
unimportant
bullseye
unimportant
sid
unimportant
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
py
bionic
dne
focal
dne
jammy
dne
kinetic
dne
lunar
dne
mantic
dne
noble
dne
trusty
ignored
xenial
ignored
python-py
bionic
not-affected
focal
not-affected
jammy
not-affected
kinetic
ignored
lunar
ignored
mantic
ignored
noble
not-affected
trusty
ignored
xenial
not-affected
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
python-py
suse enterprise sap 12
1.8.1-11.18.1
fixed
suse enterprise sap 12 SP3
1.8.1-11.18.1
fixed
suse enterprise sap 12 SP4
1.8.1-11.18.1
fixed
suse enterprise sap 12 SP5
1.8.1-11.18.1
fixed
suse enterprise server 12
1.8.1-11.18.1
fixed
suse enterprise server 12 SP3
1.8.1-11.18.1
fixed
suse enterprise server 12 SP4
1.8.1-11.18.1
fixed
suse enterprise server 12 SP5
1.8.1-11.18.1
fixed
python3-py
suse enterprise sap 12
1.8.1-11.18.1
fixed
suse enterprise sap 12 SP3
1.8.1-11.18.1
fixed
suse enterprise sap 12 SP4
1.8.1-11.18.1
fixed
suse enterprise sap 12 SP5
1.8.1-11.18.1
fixed
suse enterprise server 12
1.8.1-11.18.1
fixed
suse enterprise server 12 SP3
1.8.1-11.18.1
fixed
suse enterprise server 12 SP4
1.8.1-11.18.1
fixed
suse enterprise server 12 SP5
1.8.1-11.18.1
fixed
Common Weakness Enumeration
References
https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316
https://github.com/pytest-dev/py/issues/287
https://news.ycombinator.com/item?id=34163710
https://pypi.org/project/py
https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316
https://github.com/pytest-dev/py/issues/287
https://news.ycombinator.com/item?id=34163710
https://pypi.org/project/py