python-py vulnerability

2021-11-1000:00:00

ubuntu.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.003 Low

EPSS

Percentile

70.0%

JSON

Releases

Ubuntu 20.04 LTS
Ubuntu 18.04 ESM

Packages

python-py - Advanced Python development support library

Details

The py.path.svnwc component of py (aka python-py) through v1.9.0 contains
a regular expression with an ambiguous subpattern that is susceptible to
catastrophic backtracing. This could be used by attackers to cause a compute-time
denial of service attack by supplying malicious input to the blame functionality.

OSVersionArchitecturePackageVersionFilename
Ubuntu20.04noarchpypy-py< 1.8.1-1ubuntu0.1UNKNOWN
Ubuntu20.04noarchpython-py< 1.8.1-1ubuntu0.1UNKNOWN
Ubuntu20.04noarchpython3-py< 1.8.1-1ubuntu0.1UNKNOWN
Ubuntu18.04noarchpypy-py< 1.5.2-1ubuntu0.1UNKNOWN
Ubuntu18.04noarchpython-py< 1.5.2-1ubuntu0.1UNKNOWN
Ubuntu18.04noarchpython3-py< 1.5.2-1ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	20.04	noarch	pypy-py	< 1.8.1-1ubuntu0.1	UNKNOWN
Ubuntu	20.04	noarch	python-py	< 1.8.1-1ubuntu0.1	UNKNOWN
Ubuntu	20.04	noarch	python3-py	< 1.8.1-1ubuntu0.1	UNKNOWN
Ubuntu	18.04	noarch	pypy-py	< 1.5.2-1ubuntu0.1	UNKNOWN
Ubuntu	18.04	noarch	python-py	< 1.5.2-1ubuntu0.1	UNKNOWN
Ubuntu	18.04	noarch	python3-py	< 1.5.2-1ubuntu0.1	UNKNOWN