A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3966 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3966-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Andrej Shadura     November 26, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : pypy3     Version        : 7.3.5+dfsg-2+deb11u4     CVE ID         : CVE-2020-10735 CVE-2020-29651 CVE-2021-3737 CVE-2021-28861                      CVE-2022-0391 CVE-2022-45061 CVE-2023-27043 CVE-2024-9287

    Multiple vulnerabilities have been fixed in pypy3, an alternative     implementation of the Python 3.x language.

    CVE-2020-10735

        A flaw was found in Python. In algorithms with quadratic time         complexity using non-binary bases, when using int(text), a system         could take 50ms to parse an int string with 100,000 digits and 5s         for 1,000,000 digits (float, decimal, int.from_bytes(), and int()         for binary bases 2, 4, 8, 16, and 32 are not affected). The highest         threat from this vulnerability is to system availability.

    CVE-2020-29651

        A denial of service via regular expression in the py.path.svnwc         component of py (aka python-py) through 1.9.0 could be used by         attackers to cause a compute-time denial of service attack by         supplying malicious input to the blame functionality.
        python-py is a part of the pypy3 distribution.

    CVE-2021-3737

        A flaw was found in Python. An improperly handled HTTP response in the         HTTP client code of Python may allow a remote attacker, who controls         the HTTP server, to make the client script enter an infinite loop,         consuming CPU time. The highest threat from this vulnerability is         to system availability.

    CVE-2021-28861

        Python has an open redirection vulnerability in lib/http/server.py         due to no protection against multiple (/) at the beginning of URI         path which may leads to information disclosure.
        NOTE: this is disputed by a third party because the http.server.html         documentation page states Warning: http.server is not recommended         for production. It only implements basic security checks.

    CVE-2022-0391

        A flaw was found in Python within the urllib.parse module. This         module helps break Uniform Resource Locator (URL) strings into         components. The issue involves how the urlparse method does not         sanitize input and allows characters like '\r' and '\n' in the URL         path. This flaw allows an attacker to input a crafted URL, leading         to injection attacks.

    CVE-2022-45061

        An unnecessary quadratic algorithm exists in one path when processing         some inputs to the IDNA (RFC 3490) decoder, such that a crafted,         unreasonably long name being presented to the decoder could lead to a         CPU denial of service. Hostnames are often supplied by remote servers         that could be controlled by a malicious actor; in such a scenario,         they could trigger excessive CPU consumption on the client attempting         to make use of an attacker-supplied supposed hostname. For example,         the attack payload could be placed in the Location header of an HTTP         response with status code 302.

    CVE-2023-27043

        The email module of Python incorrectly parses e-mail addresses that         contain a special character. The wrong portion of an RFC2822 header         is identified as the value of the addr-spec. In some applications,         an attacker can bypass a protection mechanism in which application         access is granted only after verifying receipt of e-mail to a         specific domain (e.g., only @company.example.com addresses may         be used for signup). This occurs in email/_parseaddr.py.

    CVE-2024-9287

        A vulnerability has been found in the `venv` module and CLI where         path names provided when creating a virtual environment were not         quoted properly, allowing the creator to inject commands into virtual         environment activation scripts (ie source venv/bin/activate). This         means that attacker-controlled virtual environments are able to         run commands when the virtual environment is activated. Virtual         environments which are not created by an attacker or which aren't         activated before being used (ie ./venv/bin/python) are not         affected.v

    For Debian 11 bullseye, these problems have been fixed in version     7.3.5+dfsg-2+deb11u4.

    We recommend that you upgrade your pypy3 packages.

    For the detailed security status of pypy3 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/pypy3

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-py: ReDoS in the py.path.svnwc component via mailicious input to blame functionality     (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2831-1 advisory.

  - A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through     1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious     input to the blame functionality. (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5138-1 advisory.

    The py.path.svnwc component of py (aka python-py) through v1.9.0 contains

    a regular expression with an ambiguous subpattern that is susceptible to

    catastrophic backtracing. This could be used by attackers to cause a compute-time

    denial of service attack by supplying malicious input to the blame functionality.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

An update of the python package has been released.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1859-1 advisory.

  - A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through     1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious     input to the blame functionality. (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:2236-1 advisory.

  - A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through     1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious     input to the blame functionality. (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:1859-1 advisory.

  - A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through     1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious     input to the blame functionality. (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python-py fixes the following issues :

  - CVE-2020-29651: Fixed regular expression denial of     service in svnwc.py (bsc#1179805, bsc#1184505).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

#### 1.10.0 (2020-12-12) ####

  - Fix a regular expression DoS vulnerability in the     py.path.svnwc SVN blame functionality (CVE-2020-29651)

  - Update vendored apipkg: 1.4 => 1.5

  - Update vendored iniconfig: 1.0.0 => 1.1.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

#### 1.10.0 (2020-12-12) ####

  - Fix a regular expression DoS vulnerability in the     py.path.svnwc SVN blame functionality (CVE-2020-29651)

  - Update vendored apipkg: 1.4 => 1.5

  - Update vendored iniconfig: 1.0.0 => 1.1.1

#### 1.9.0 (2020-06-24) ####

  - Add type annotation stubs for the following modules :

  - ``py.error``

  - ``py.iniconfig``

  - ``py.path`` (not including SVN paths)

  - ``py.io``

  - ``py.xml``

    There are no plans to type other modules at this time.

    The type annotations are provided in external .pyi     files, not inline in the code, and may therefore contain     small errors or omissions. If you use ``py`` in     conjunction with a type checker, and encounter any type     errors you believe should be accepted, please report it     in an issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
211850	Debian dla-3966 : pypy3 - security update	Nessus	Debian Local Security Checks	high
199597	RHEL 8 : python-py (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196058	RHEL 7 : python-py (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
164269	SUSE SLED15 / SLES15 : Recommended update for aws-efs-utils, python-ansi2html, python-py, python-pytest-html, python-pytest-metadata, python-pytest-rerunfailures, python-coverage, python-oniconfig, python-unittest-mixins (SUSE-SU-2022:2831-1)	Nessus	SuSE Local Security Checks	high
155162	Ubuntu 18.04 LTS / 20.04 LTS : python-py vulnerability (USN-5138-1)	Nessus	Ubuntu Local Security Checks	high
153936	Photon OS 4.0: Python3 PHSA-2021-4.0-0051	Nessus	PhotonOS Local Security Checks	high
153933	Photon OS 2.0: Python PHSA-2021-2.0-0362	Nessus	PhotonOS Local Security Checks	high
152370	Photon OS 1.0: Python PHSA-2021-1.0-0419	Nessus	PhotonOS Local Security Checks	high
151728	openSUSE 15 Security Update : python-py (openSUSE-SU-2021:1859-1)	Nessus	SuSE Local Security Checks	high
151360	SUSE SLES12 Security Update : python-py (SUSE-SU-2021:2236-1)	Nessus	SuSE Local Security Checks	high
150697	SUSE SLED15 / SLES15 Security Update : python-py (SUSE-SU-2021:1859-1)	Nessus	SuSE Local Security Checks	high
150466	openSUSE Security Update : python-py (openSUSE-2021-851)	Nessus	SuSE Local Security Checks	high
144730	Fedora 33 : python-py (2020-8371993b6b)	Nessus	Fedora Local Security Checks	high
144729	Fedora 32 : python-py (2020-db0eb54982)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-29651

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high