PYSEC-2022-43183

Retiré · 2026-06-09 10:45 UTC

En bref

Publiée: 2022-10-16 06:15 UTC
Mise à jour: 2026-06-09 13:30 UTC
CVE: CVE-2022-42969
Alias: GHSA-w596-4wvx-j9j6, PYSEC-2022-42969
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.

Paquets affectés

Paquet	Versions
PyPI · py

Références

https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316 WEB
https://github.com/pytest-dev/py/issues/287 REPORT
https://news.ycombinator.com/item?id=34163710 REPORT
https://pypi.org/project/py PACKAGE

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database