CVE-2022-42969 Denial of service in n/a
Remote attackers could cause denial of service in the Python py library via crafted Subversion data, though the vulnerability is disputed as unreproducible.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-42969?
CVE-2022-42969 is a medium-severity denial of service vulnerability in n/a, published on 16 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled. Note: This has been disputed by multiple third parties as not being reproduceable and they argue this is not a valid vulnerability.
Weakness: CWE-1333
Which versions are affected by CVE-2022-42969?
It affects 1 product.
Linux distribution packages (16)
python-py SUSE:Linux Enterprise Micro 5.1 | All versions | 1.10.0-150100.5.12.1 |
python-py SUSE:Linux Enterprise Micro 5.2 | All versions | 1.10.0-150100.5.12.1 |
python-py SUSE:Linux Enterprise Micro 5.3 | All versions | 1.10.0-150100.5.12.1 |
python-py SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.10.0-150100.5.12.1 |
python-py SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 1.8.1-11.15.2 |
python-py SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 1.8.1-11.18.1 |
python-py SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 1.10.0-150100.5.12.1 |
python-py SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.8.1-11.15.2 |
python-py SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.8.1-11.18.1 |
python-py SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.8.1-11.15.2 |
python-py SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.8.1-11.18.1 |
python-py SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.8.1-11.15.2 |
python-py SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.8.1-11.18.1 |
python-py openSUSE:Leap 15.4 | All versions | 1.10.0-150100.5.12.1 |
python-py openSUSE:Leap Micro 5.2 | All versions | 1.10.0-150100.5.12.1 |
python-py openSUSE:Leap Micro 5.3 | All versions | 1.10.0-150100.5.12.1 |
Products include Pytest Py.
How do I fix CVE-2022-42969?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-42969 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-42969 exists.
Sources
Also known as CLSA-2026-1771978234, DEBIAN-CVE-2022-42969, MGASA-2025-0289, SUSE-SU-2023:0161-1, SUSE-SU-2023:0395-1, SUSE-SU-2023:0681-1 and 1 more.