What’s Vulnerable › Vulnerabilities

CVE-2022-42969

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-10-16 · updated 2026-06-17
• Weakness: CWE-1333

Description

The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.

Affected products

• pytest Py: through 1.11.0

References

• https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316
• https://github.com/pytest-dev/py/issues/287
• https://news.ycombinator.com/item?id=34163710
• https://pypi.org/project/py
• https://github.com/pytest-dev/py/blob/cb87a83960523a2367d0f19226a73aed4ce4291d/py/_path/svnurl.py#L316
• https://github.com/pytest-dev/py/issues/287
• https://news.ycombinator.com/item?id=34163710
• https://pypi.org/project/py

Get alerted when CVE-2022-42969 or the next vulnerability affects your stack