CVE-2022-42969
published 2022-10-16CVE-2022-42969: The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.55%
72.2th percentile
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-py | — | — |
| msrc | cbl2_python-py_1.10.0-3_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_python-py_1.10.0-1_on_cbl_mariner_1.0 | — | — |
| pytest | py | <= 1.11.0 | — |
| pytest | py | 0 – 1.11.0 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ghsa7.5HIGH
osv7.5HIGH
vendor_debian5.3LOW
vendor_msrc5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2022-42969: The py library through 1
osv·2022-11-04
CVE-2022-42969 CVE-2022-42969: The py library through 1
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.
OSV
CVE-2022-42969: The py library through 1
osv·2022-10-16·CVSS 7.5
CVE-2022-42969 [HIGH] CVE-2022-42969: The py library through 1
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
GHSA
Withdrawn Advisory: ReDoS in py library when used with subversion
ghsa·2022-10-16·CVSS 7.5
CVE-2022-42969 [HIGH] CWE-1333 Withdrawn Advisory: ReDoS in py library when used with subversion
Withdrawn Advisory: ReDoS in py library when used with subversion
### Withdrawn Advisory
This advisory has been withdrawn because evidence does not suggest that CVE-2022-42969 is a valid, reproducible vulnerability. This link is maintained to preserve external references.
### Original Description
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.
The particular codepath in question is the regular expression at `py._path.svnurl.InfoSvnCommand.lspattern` and is only relevant when dealing with subversion (svn) projects. Notably the codepath is not used in the popular pytest project. The developers of the pytest
OSV
CVE-2022-42969: ** DISPUTED ** The py library through 1
osv·2022-10-16·CVSS 7.5
CVE-2022-42969 [HIGH] CVE-2022-42969: ** DISPUTED ** The py library through 1
** DISPUTED ** The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
OSV
Withdrawn Advisory: ReDoS in py library when used with subversion
osv·2022-10-16·CVSS 7.5
CVE-2022-42969 [HIGH] Withdrawn Advisory: ReDoS in py library when used with subversion
Withdrawn Advisory: ReDoS in py library when used with subversion
### Withdrawn Advisory
This advisory has been withdrawn because evidence does not suggest that CVE-2022-42969 is a valid, reproducible vulnerability. This link is maintained to preserve external references.
### Original Description
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.
The particular codepath in question is the regular expression at `py._path.svnurl.InfoSvnCommand.lspattern` and is only relevant when dealing with subversion (svn) projects. Notably the codepath is not used in the popular pytest project. The developers of the pytest
Red Hat
py: ReDoS in py library when used with subversion
vendor_redhat·2022-10-16·CVSS 5.3
CVE-2022-42969 [MEDIUM] CWE-1333 py: ReDoS in py library when used with subversion
py: ReDoS in py library when used with subversion
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
Statement: This has been disputed by multiple parties, including the upstream maintainers, as not being reproducible or a valid vulnerability.
Package: ose-aws-efs-utils-container (Red Hat OpenShift Container Platform 4) - Fix deferred
Package: stf/prometheus-webhook-snmp-rhel8 (Service Telemetry Framework 1.5) - Fix deferred
Microsoft
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSv
vendor_msrc·2022-10-11·CVSS 5.3
CVE-2022-42969 [MEDIUM] CWE-1333 The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSv
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work wh
Debian
CVE-2022-42969: python-py - The py library through 1.11.0 for Python allows remote attackers to conduct a Re...
vendor_debian·2022·CVSS 5.3
CVE-2022-42969 [MEDIUM] CVE-2022-42969: python-py - The py library through 1.11.0 for Python allows remote attackers to conduct a Re...
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316https://github.com/pytest-dev/py/issues/287https://news.ycombinator.com/item?id=34163710https://pypi.org/project/pyhttps://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316https://github.com/pytest-dev/py/issues/287https://news.ycombinator.com/item?id=34163710https://pypi.org/project/py
2022-10-16
Published