CVE-2022-42969 describes a Regular expression Denial of Service (ReDoS) vulnerability in the Python 'py' library, versions through 1.11.0, affecting the handling of Subversion repository info data. With a CVSS score of 7.5 (HIGH), this vulnerability could allow unauthenticated remote attackers to cause a denial of service with low attack complexity. Despite the high severity, there is no evidence of active exploitation, no public exploit code, and minimal community discussion, with some third parties disputing its reproducibility.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.11.0CPE matchmatch criteria | cpe:2.3:a:pytest:py:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Third-Party Package Updates in Splunk Enterprise - October 2024
Oct 14, 2024Withdrawn Advisory: ReDoS in py library when used with subversion
Oct 16, 2022py: ReDoS in py library when used with subversion
Oct 16, 2022The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
Oct 11, 2022