CVE-2020-29651 py vulnerable to Regular Expression Denial of Service
High 7.5
Published
Updated
Check this codebase for CVE-2020-29651 and fix it if it is affected.
What it is: CVE-2020-29651 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 9 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2020-29651 in the wild and no public exploit code.
Affected packages and fixed versions:
- py (PyPI): affected all versions; fixed in 1.10.0
- py (PyPI): affected all versions; fixed in 1.10.0
- py (PyPI): affected all versions; fixed in 1.10.0
Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.
Reference: https://insights.sbomify.com/CVE-2020-29651/ (Markdown: https://insights.sbomify.com/CVE-2020-29651/index.md)
Attackers can cause a compute-time denial of service in the py.path.svnwc component by supplying malicious input to the blame functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-29651?
CVE-2020-29651 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 9 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.
Which versions are affected by CVE-2020-29651?
3 open source packages ship an affected version, including py. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
py PyPI | All versions | 1.10.0 |
py PyPI | All versions | 1.10.0 |
py PyPI | All versions | 1.10.0 |
Linux distribution packages (37)
python-py SUSE:Linux Enterprise Micro 5.0 | All versions | 1.8.1-5.6.1 |
python-py SUSE:Linux Enterprise Micro 5.1 | All versions | 1.10.0-150000.5.9.2 |
python-py SUSE:Linux Enterprise Micro 5.2 | All versions | 1.10.0-150000.5.9.2 |
python-py SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 1.8.1-5.6.1 |
python-apipkg SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 1.4-150000.3.2.1 |
python-iniconfig SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 1.1.1-150000.1.3.1 |
python-py SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 1.10.0-150000.5.9.2 |
python-py SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 1.8.1-5.6.1 |
python-apipkg SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.4-150000.3.2.1 |
python-iniconfig SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.1.1-150000.1.3.1 |
python-py SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.10.0-150000.5.9.2 |
python-coverage SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 4.5.4-150000.3.3.2 |
python-coverage SUSE:Linux Enterprise Module for Development Tools 15 SP4 | All versions | 4.5.4-150000.3.3.2 |
python-atomicwrites SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 1.1.5-150000.3.2.1 |
python-coverage SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 4.5.4-150000.3.3.2 |
python-atomicwrites SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 1.1.5-150000.3.2.1 |
python-coverage SUSE:Linux Enterprise Module for Package Hub 15 SP4 | All versions | 4.5.4-150000.3.3.2 |
python-atomicwrites SUSE:Linux Enterprise Module for Public Cloud 15 SP1 | All versions | 1.1.5-150000.3.2.1 |
python-atomicwrites SUSE:Linux Enterprise Module for Public Cloud 15 SP2 | All versions | 1.1.5-150000.3.2.1 |
python-atomicwrites SUSE:Linux Enterprise Module for Public Cloud 15 SP3 | All versions | 1.1.5-150000.3.2.1 |
python-atomicwrites SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 1.1.5-150000.3.2.1 |
python-py SUSE:Linux Enterprise Module for Python 2 15 SP2 | All versions | 1.8.1-5.6.1 |
python-apipkg SUSE:Linux Enterprise Module for Python 2 15 SP3 | All versions | 1.4-150000.3.2.1 |
python-iniconfig SUSE:Linux Enterprise Module for Python 2 15 SP3 | All versions | 1.1.1-150000.1.3.1 |
python-py SUSE:Linux Enterprise Module for Python 2 15 SP3 | All versions | 1.10.0-150000.5.9.2 |
python-py SUSE:Linux Enterprise Module for Python 2 15 SP3 | All versions | 1.8.1-5.6.1 |
python-py SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.8.1-11.12.4 |
python-py SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.8.1-11.12.4 |
python-py SUSE:OpenStack Cloud 7 | All versions | 1.8.1-11.12.4 |
python-py openSUSE:Leap 15.2 | All versions | 1.8.1-lp152.2.6.1 |
python-py-test openSUSE:Leap 15.2 | All versions | 1.8.1-lp152.2.6.1 |
python-apipkg openSUSE:Leap 15.3 | All versions | 1.4-150000.3.2.1 |
python-atomicwrites openSUSE:Leap 15.3 | All versions | 1.1.5-150000.3.2.1 |
python-atomicwrites-doc openSUSE:Leap 15.3 | All versions | 1.1.5-150000.3.2.1 |
python-coverage openSUSE:Leap 15.3 | All versions | 4.5.4-150000.3.3.2 |
python-py openSUSE:Leap 15.3 | All versions | 1.10.0-150000.5.9.2 |
python-py openSUSE:Leap 15.3 | All versions | 1.8.1-5.6.1 |
Products include Fedoraproject Fedora, Oracle Zfs Storage Appliance Kit, Pytest Py.
How do I fix CVE-2020-29651?
Upgrade py to 1.10.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-29651 being exploited?
There is no known exploitation of CVE-2020-29651 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2020-29651, GHSA-hj5v-574p-mj7c, MGASA-2021-0071, OESA-2022-1562, PYSEC-2020-92, SUSE-SU-2021:1859-1 and 8 more.