{"id":"CVE-2022-42969","aliases":["CLSA-2026-1771978234","DEBIAN-CVE-2022-42969","EUVD-2022-0207","GHSA-w596-4wvx-j9j6","MGASA-2025-0289","PYSEC-2022-42969","PYSEC-2022-43183","SUSE-SU-2023:0161-1","SUSE-SU-2023:0395-1","SUSE-SU-2023:0681-1","openSUSE-SU-2024:13211-1","openSUSE-SU-2026:12027-1"],"status":"disputed","title":"Withdrawn Advisory: ReDoS in py library when used with subversion","description":"The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02102,"percentile":0.81855,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2022-10-16T00:00:00Z","modified":"2026-11-03T08:03:17Z","fixes":[{"ecosystem":"TuxCare:PyPI","package":"py","fixed_in":["1.11.0.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"python-py","fixed_in":["1.11.0-2.1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-py","fixed_in":["1.10.0-150100.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-py","fixed_in":["1.10.0-150100.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"python-py","fixed_in":["1.10.0-150100.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"python-py","fixed_in":["1.10.0-150100.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"python-py","fixed_in":["1.10.0-150100.5.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.2","package":"python-py","fixed_in":["1.10.0-150100.5.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"python-py","fixed_in":["1.10.0-150100.5.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-py","fixed_in":["1.10.0-150100.5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-py","fixed_in":["1.8.1-11.15.2","1.8.1-11.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"python-py","fixed_in":["1.8.1-11.15.2","1.8.1-11.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"python-py","fixed_in":["1.8.1-11.15.2","1.8.1-11.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"python-py","fixed_in":["1.8.1-11.15.2","1.8.1-11.18.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:PyPI","package":"py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.0.post1+tuxcare"}]}],"versions":["1.11.0"]},{"source":"osv","ecosystem":"Debian:12","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-1","1.11.0-2","1.11.0-3","1.11.0-4","1.11.0-5","1.11.0-6"]},{"source":"osv","ecosystem":"Debian:13","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-4","1.11.0-5","1.11.0-6"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-2.1.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-150100.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-150100.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-150100.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-150100.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-150100.5.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-150100.5.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-150100.5.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.0-150100.5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-11.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-11.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-11.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-11.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-11.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-11.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-11.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-11.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-9.5"}]}],"bundled":2}],"products":[{"vendor":"pytest","product":"py"}],"references":[{"url":"https://pypi.org/project/py","tags":["x_transferred","Product","package","web"]},{"url":"https://github.com/pytest-dev/py/issues/287","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316","tags":["x_transferred","Product","web"]},{"url":"https://news.ycombinator.com/item?id=34163710","tags":["x_transferred","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42969","tags":["advisory","web"]},{"url":"https://github.com/pytest-dev/py/issues/288","tags":["web","report"]},{"url":"https://github.com/pytest-dev/pytest/issues/10392","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-w596-4wvx-j9j6","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/py/PYSEC-2022-42969.yaml","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/py/PYSEC-2022-43183.yaml","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42969.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-42969","tags":["advisory"]},{"url":"https://github.com/pytest-dev/py","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0289.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31458","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-January/013536.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ELXQR2N4BOTGP4YQAZGZJDQMETKR6DWY/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230161-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204364","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42969","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230395-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230681-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208181","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29651","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-42969","description":"The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.","status":"disputed","published":"2022-10-16T00:00:00Z","modified":"2025-05-14T14:15:50.246Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:34:27.327929Z"}],"euvd":[{"id":"EUVD-2022-0207","description":"The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.","status":"published","published":"2022-10-16T00:00:00Z","modified":"2025-05-14T14:15:50Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N","level":"medium"}],"updated_at":"2026-11-02T20:32:47.93917Z"}],"ghsa":[{"id":"GHSA-w596-4wvx-j9j6","title":"Withdrawn Advisory: ReDoS in py library when used with subversion ","description":"### Withdrawn Advisory\nThis advisory has been withdrawn because evidence does not suggest that CVE-2022-42969 is a valid, reproducible vulnerability. This link is maintained to preserve external references.\n\n### Original Description\nThe py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.\n\nThe particular codepath in question is the regular expression at `py._path.svnurl.InfoSvnCommand.lspattern` and is only relevant when dealing with subversion (svn) projects. Notably the codepath is not used in the popular pytest project. The developers of the pytest package have released version `7.2.0` which removes their dependency on `py`. Users of `pytest` seeing alerts relating to this advisory may update to version `7.2.0` of `pytest` to resolve this issue. See https://github.com/pytest-dev/py/issues/287#issuecomment-1290407715 for additional context.","status":"withdrawn","published":"2022-10-16T12:00:23Z","modified":"2026-05-29T20:51:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:40:15.638885Z"}],"nvd":[{"id":"CVE-2022-42969","description":"The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.","status":"disputed","published":"2022-10-16T06:15:09.797Z","modified":"2026-06-17T05:05:41.397Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:07:30.6869Z"}],"osv":[{"id":"CVE-2022-42969","description":"The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.","status":"published","published":"2022-10-16T00:00:00Z","modified":"2026-10-28T02:31:06.778602989Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AC:L/AV:N/A:L/C:N/I:N/PR:N/S:U/UI:N","level":"medium"}],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"DEBIAN-CVE-2022-42969","description":"The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.","status":"published","published":"2022-10-16T06:15:09.797Z","modified":"2026-11-03T08:03:17.703779439Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"GHSA-w596-4wvx-j9j6","title":"Withdrawn Advisory: ReDoS in py library when used with subversion ","description":"### Withdrawn Advisory\nThis advisory has been withdrawn because evidence does not suggest that CVE-2022-42969 is a valid, reproducible vulnerability. This link is maintained to preserve external references.\n\n### Original Description\nThe py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.\n\nThe particular codepath in question is the regular expression at `py._path.svnurl.InfoSvnCommand.lspattern` and is only relevant when dealing with subversion (svn) projects. Notably the codepath is not used in the popular pytest project. The developers of the pytest package have released version `7.2.0` which removes their dependency on `py`. Users of `pytest` seeing alerts relating to this advisory may update to version `7.2.0` of `pytest` to resolve this issue. See https://github.com/pytest-dev/py/issues/287#issuecomment-1290407715 for additional context.","status":"withdrawn","published":"2022-10-16T12:00:23Z","modified":"2026-09-10T03:49:46.736589852Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"PYSEC-2022-43183","description":"The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.","status":"withdrawn","published":"2022-10-16T06:15:09.797Z","modified":"2026-06-09T13:30:10.101554512Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"CLSA-2026-1771978234","title":"TuxCare security update for py (1 CVE)","description":"TuxCare rebuilt py to address 1 CVE. Fixed in 1.11.0.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-20T13:45:23.259732695Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"MGASA-2025-0289","title":"Updated python-py packages fix security vulnerability","description":"The py library through 1.11.0 for Python allows remote attackers to\nconduct a ReDoS (Regular expression Denial of Service) attack via a\nSubversion repository with crafted info data, because the InfoSvnCommand\nargument is mishandled. (CVE-2022-42969)\n","status":"published","published":"2025-11-13T23:37:22Z","modified":"2026-04-16T04:43:49.770806541Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:13211-1","title":"python310-py-1.11.0-6.1 on GA media","description":"These are all security issues fixed in the python310-py-1.11.0-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:57:39.874651Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2026:12027-1","title":"python313-py-1.11.0-9.5 on GA media","description":"These are all security issues fixed in the python313-py-1.11.0-9.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:51.925960914Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"PYSEC-2022-42969","description":"The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.","status":"withdrawn","published":"2022-11-04T11:00:00Z","modified":"2026-06-09T13:30:10.233331786Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"SUSE-SU-2023:0161-1","title":"Security update for python-py","description":"This update for python-py fixes the following issues:\n\n- CVE-2022-42969: Fixed an excessive resource consumption that could\n  be triggered when interacting with a Subversion repository\n  containing crated data (bsc#1204364).\n","status":"published","published":"2023-01-26T17:23:37Z","modified":"2026-02-04T03:56:47.867266Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0395-1","title":"Security update for python-py","description":"This update for python-py fixes the following issues:\n\n- CVE-2022-42969: Fixed an excessive resource consumption that could\n  be triggered when interacting with a Subversion repository\n  containing crated data (bsc#1204364).\n\nThis also updates python3-py to version 1.8.1 for SUSE Linux Enterprise Server.\n","status":"published","published":"2023-02-13T09:11:02Z","modified":"2026-02-04T03:24:40.990324Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0681-1","title":"Security update for python-py","description":"This update for python-py fixes the following issues:\n\n  Bugfixes:\n\n  - Fixed bugs introduced with the fix for CVE-2022-42969 (bsc#1204364, bsc#1208181).\n\n","status":"published","published":"2023-03-08T16:28:00Z","modified":"2026-02-04T02:49:15.093964Z","updated_at":"2026-11-02T15:53:52.350754Z"}]}}