SB2023013033 - Denial of service in python-py

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect Regular Expression (CVE-ID: CVE-2022-42969)

CWE-ID: CWE-185 - Incorrect Regular Expression

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation in Subversion repository caused by a mishandled InfoSvnCommand argument. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316
• https://github.com/pytest-dev/py/issues/287
• https://github.com/advisories/GHSA-w596-4wvx-j9j6