CVE-2022-39280 Regular expression denial of service in dparse
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2022-39280?
CVE-2022-39280 is a medium-severity vulnerability in pyupio dparse, published on 6 Oct 2022.
Official description
dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index server URLs with dparse are impacted by this vulnerability. A patch has been applied in version `0.5.2`, all the users are advised to upgrade to `0.5.2` as soon as possible. Users unable to upgrade should avoid passing index server URLs in the source file to be parsed.
Which versions are affected by CVE-2022-39280?
3 open source packages ship an affected version, including dparse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dparse PyPI | All versions | 0.5.2 |
dparse PyPI | All versions | 0.5.2 |
dparse PyPI | All versions | 0.5.2 |
Products include Pyup Dependency Parser.
How do I fix CVE-2022-39280?
Upgrade dparse to 0.5.2 or later.
Is CVE-2022-39280 being exploited?
There is no known exploitation of CVE-2022-39280 in the wild and no public exploit code.
Sources
Also known as GHSA-8fg9-p83m-x5pq, PYSEC-2022-301.