CVE-2022-42969
Withdrawn Advisory: ReDoS in py library when used with subversion
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
- Record
CVE-2022-42969- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N - Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2022-0207
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
- Record
EUVD-2022-0207- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w596-4wvx-j9j6
Withdrawn Advisory: ReDoS in py library when used with subversion
Withdrawn Advisory
This advisory has been withdrawn because evidence does not suggest that CVE-2022-42969 is a valid, reproducible vulnerability. This link is maintained to preserve external references.
Original Description
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.
The particular codepath in question is the regular expression at py._path.svnurl.InfoSvnCommand.lspattern and is only relevant when dealing with subversion (svn) projects. Notably the codepath is not used in the popular pytest project. The developers of the pytest package have released version 7.2.0 which removes their dependency on py. Users of pytest seeing alerts relating to this advisory may update to version 7.2.0 of pytest to resolve this issue. See https://github.com/pytest-dev/py/issues/287#issuecomment-1290407715 for additional context.
- Record
GHSA-w596-4wvx-j9j6- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
NVD
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
- Record
CVE-2022-42969- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSV
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
- Record
CVE-2022-42969- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-42969
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
- Record
DEBIAN-CVE-2022-42969- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
Show 10 moreShow less
OSVGHSA-w596-4wvx-j9j6
Withdrawn Advisory: ReDoS in py library when used with subversion
Withdrawn Advisory
This advisory has been withdrawn because evidence does not suggest that CVE-2022-42969 is a valid, reproducible vulnerability. This link is maintained to preserve external references.
Original Description
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.
The particular codepath in question is the regular expression at py._path.svnurl.InfoSvnCommand.lspattern and is only relevant when dealing with subversion (svn) projects. Notably the codepath is not used in the popular pytest project. The developers of the pytest package have released version 7.2.0 which removes their dependency on py. Users of pytest seeing alerts relating to this advisory may update to version 7.2.0 of pytest to resolve this issue. See https://github.com/pytest-dev/py/issues/287#issuecomment-1290407715 for additional context.
- Record
GHSA-w596-4wvx-j9j6- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVPYSEC-2022-43183
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
- Record
PYSEC-2022-43183- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1771978234 No score
TuxCare security update for py (1 CVE)
TuxCare rebuilt py to address 1 CVE. Fixed in 1.11.0.post1+tuxcare.
- Record
CLSA-2026-1771978234- Updated
- 2026-11-02
OSVMGASA-2025-0289 No score
Updated python-py packages fix security vulnerability
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. (CVE-2022-42969)
- Record
MGASA-2025-0289- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13211-1 No score
python310-py-1.11.0-6.1 on GA media
These are all security issues fixed in the python310-py-1.11.0-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13211-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12027-1 No score
python313-py-1.11.0-9.5 on GA media
These are all security issues fixed in the python313-py-1.11.0-9.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12027-1- Updated
- 2026-11-02
OSVPYSEC-2022-42969 No score
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.
- Record
PYSEC-2022-42969- Updated
- 2026-11-02
OSVSUSE-SU-2023:0161-1 No score
Security update for python-py
This update for python-py fixes the following issues:
- CVE-2022-42969: Fixed an excessive resource consumption that could be triggered when interacting with a Subversion repository containing crated data (bsc#1204364).
- Record
SUSE-SU-2023:0161-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0395-1 No score
Security update for python-py
This update for python-py fixes the following issues:
- CVE-2022-42969: Fixed an excessive resource consumption that could be triggered when interacting with a Subversion repository containing crated data (bsc#1204364).
This also updates python3-py to version 1.8.1 for SUSE Linux Enterprise Server.
- Record
SUSE-SU-2023:0395-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0681-1 No score
Security update for python-py
This update for python-py fixes the following issues:
Bugfixes:
- Fixed bugs introduced with the fix for CVE-2022-42969 (bsc#1204364, bsc#1208181).
- Record
SUSE-SU-2023:0681-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyTuxCare:PyPI |
1.11.0 up to 1.11.0.post1+tuxcare | 1.11.0.post1+tuxcare |
python-pyDebian:12 |
All versions, plus listed versions 1.11.0-11.11.0-21.11.0-31.11.0-41.11.0-51.11.0-6 |
None known |
python-pyDebian:13 |
All versions, plus listed versions 1.11.0-41.11.0-51.11.0-6 |
None known |
python-pyMageia:9 |
before 1.11.0-2.1.mga9 | 1.11.0-2.1.mga9 |
python-pySUSE:Linux Enterprise Micro 5.3 |
before 1.10.0-150100.5.12.1 | 1.10.0-150100.5.12.1 |
python-pySUSE:Linux Enterprise Module for Basesystem 15 SP4 |
before 1.10.0-150100.5.12.1 | 1.10.0-150100.5.12.1 |
python-pySUSE:Linux Enterprise Real Time 15 SP3 |
before 1.10.0-150100.5.12.1 | 1.10.0-150100.5.12.1 |
python-pySUSE:Linux Enterprise Micro 5.1 |
before 1.10.0-150100.5.12.1 | 1.10.0-150100.5.12.1 |
python-pySUSE:Linux Enterprise Micro 5.2 |
before 1.10.0-150100.5.12.1 | 1.10.0-150100.5.12.1 |
python-pyopenSUSE:Leap Micro 5.2 |
before 1.10.0-150100.5.12.1 | 1.10.0-150100.5.12.1 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-pyopenSUSE:Leap Micro 5.3 |
before 1.10.0-150100.5.12.1 | 1.10.0-150100.5.12.1 |
python-pyopenSUSE:Leap 15.4 |
before 1.10.0-150100.5.12.1 | 1.10.0-150100.5.12.1 |
python-pySUSE:Linux Enterprise Module for Public Cloud 12 |
before 1.8.1-11.15.2 | 1.8.1-11.15.2 |
python-pySUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.8.1-11.15.2 | 1.8.1-11.15.2 |
python-pySUSE:Linux Enterprise Server 12 SP5 |
before 1.8.1-11.15.2 | 1.8.1-11.15.2 |
python-pySUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.8.1-11.15.2 | 1.8.1-11.15.2 |
python-pySUSE:Linux Enterprise Module for Public Cloud 12 |
before 1.8.1-11.18.1 | 1.8.1-11.18.1 |
python-pySUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.8.1-11.18.1 | 1.8.1-11.18.1 |
python-pySUSE:Linux Enterprise Server 12 SP5 |
before 1.8.1-11.18.1 | 1.8.1-11.18.1 |
python-pySUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.8.1-11.18.1 | 1.8.1-11.18.1 |
python-pyopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.11.0-9.5 | 1.11.0-9.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-42969 is a medium vulnerability (CVSS 5.3) in Pytest Py, published October 16, 2022. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in py 1.11.0.post1+tuxcare.
References
pypi.org/project/py
github.com/pytest-dev/py/issues/287
news.ycombinator.com/item?id=34163710
nvd.nist.gov/vuln/detail/CVE-2022-42969
Show 18 moreShow less
security-tracker.debian.org/tracker/CVE-2022-42969
advisories.mageia.org/MGASA-2025-0289.html
bugs.mageia.org/show_bug.cgi?id=31458
lists.suse.com/pipermail/sle-security-updates/2023-January/013536.html
lists.opensuse.org/archives/list/[email protected]/thread/ELXQR2N4BOTGP4YQAZGZJDQMETKR6DWY
suse.com/support/update/announcement/2023/suse-su-20230161-1
bugzilla.suse.com/1204364