A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-py: ReDoS in the py.path.svnwc component via mailicious input to blame functionality     (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2831-1 advisory.

  - A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through     1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious     input to the blame functionality. (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5138-1 advisory.

  - A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through     1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious     input to the blame functionality. (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python3 package has been released.

  - A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through     1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious     input to the blame functionality. (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python package has been released.

  - A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through     1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious     input to the blame functionality. (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python package has been released.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1859-1 advisory.

  - A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through     1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious     input to the blame functionality. (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2021:2236-1 advisory.

  - A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through     1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious     input to the blame functionality. (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:1859-1 advisory.

  - A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through     1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious     input to the blame functionality. (CVE-2020-29651)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python-py fixes the following issues :

  - CVE-2020-29651: Fixed regular expression denial of     service in svnwc.py (bsc#1179805, bsc#1184505).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

#### 1.10.0 (2020-12-12) ####

  - Fix a regular expression DoS vulnerability in the     py.path.svnwc SVN blame functionality (CVE-2020-29651)

  - Update vendored apipkg: 1.4 => 1.5

  - Update vendored iniconfig: 1.0.0 => 1.1.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

#### 1.10.0 (2020-12-12) ####

  - Fix a regular expression DoS vulnerability in the     py.path.svnwc SVN blame functionality (CVE-2020-29651)

  - Update vendored apipkg: 1.4 => 1.5

  - Update vendored iniconfig: 1.0.0 => 1.1.1

#### 1.9.0 (2020-06-24) ####

  - Add type annotation stubs for the following modules :

  - ``py.error``

  - ``py.iniconfig``

  - ``py.path`` (not including SVN paths)

  - ``py.io``

  - ``py.xml``

    There are no plans to type other modules at this time.

    The type annotations are provided in external .pyi     files, not inline in the code, and may therefore contain     small errors or omissions. If you use ``py`` in     conjunction with a type checker, and encounter any type     errors you believe should be accepted, please report it     in an issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
196058	RHEL 7 : python-py (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
164269	SUSE SLED15 / SLES15 : Recommended update for aws-efs-utils, python-ansi2html, python-py, python-pytest-html, python-pytest-metadata, python-pytest-rerunfailures, python-coverage, python-oniconfig, python-unittest-mixins (SUSE-SU-2022:2831-1)	Nessus	SuSE Local Security Checks	high
155162	Ubuntu 18.04 LTS / 20.04 LTS : python-py vulnerability (USN-5138-1)	Nessus	Ubuntu Local Security Checks	high
153936	Photon OS 4.0: Python3 PHSA-2021-4.0-0051	Nessus	PhotonOS Local Security Checks	high
153933	Photon OS 2.0: Python PHSA-2021-2.0-0362	Nessus	PhotonOS Local Security Checks	high
152370	Photon OS 1.0: Python PHSA-2021-1.0-0419	Nessus	PhotonOS Local Security Checks	high
151728	openSUSE 15 Security Update : python-py (openSUSE-SU-2021:1859-1)	Nessus	SuSE Local Security Checks	high
151360	SUSE SLES12 Security Update : python-py (SUSE-SU-2021:2236-1)	Nessus	SuSE Local Security Checks	high
150697	SUSE SLED15 / SLES15 Security Update : python-py (SUSE-SU-2021:1859-1)	Nessus	SuSE Local Security Checks	high
150466	openSUSE Security Update : python-py (openSUSE-2021-851)	Nessus	SuSE Local Security Checks	high
144730	Fedora 33 : python-py (2020-8371993b6b)	Nessus	Fedora Local Security Checks	high
144729	Fedora 32 : python-py (2020-db0eb54982)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-29651

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high