GHSA-w596-4wvx-j9j6
Suggest an improvement- Source
- https://github.com/advisories/GHSA-w596-4wvx-j9j6
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-w596-4wvx-j9j6/GHSA-w596-4wvx-j9j6.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-w596-4wvx-j9j6
- Aliases
- Published
- 2022-10-16T12:00:23Z
- Modified
- 2024-10-21T20:23:50.504822Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- ReDoS in py library when used with subversion
- Details
-
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.
The particular codepath in question is the regular expression at
py._path.svnurl.InfoSvnCommand.lspatternand is only relevant when dealing with subversion (svn) projects. Notably the codepath is not used in the popular pytest project. The developers of the pytest package have released version7.2.0which removes their dependency onpy. Users ofpytestseeing alerts relating to this advisory may update to version7.2.0ofpytestto resolve this issue. See https://github.com/pytest-dev/py/issues/287#issuecomment-1290407715 for additional context. - References
-
- https://nvd.nist.gov/vuln/detail/CVE-2022-42969
- https://github.com/pytest-dev/py/issues/287
- https://github.com/pytest-dev/py/issues/288
- https://github.com/pytest-dev/pytest/issues/10392
- https://github.com/advisories/GHSA-w596-4wvx-j9j6
- https://github.com/pypa/advisory-database/tree/main/vulns/py/PYSEC-2022-42969.yaml
- https://github.com/pytest-dev/py
- https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316
- https://news.ycombinator.com/item?id=34163710
- https://pypi.org/project/py
Affected packages
PyPI / py
Package
- Name
- py
- View open source insights on deps.dev
- Purl
- pkg:pypi/py
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedLast affected1.11.0