CVE-2022-42969: pytest-dev py ReDoS in Subversion InfoSvnCommand

Executive brief

The 'py' Python library, a utility used by various development tools, contains a flaw in how it processes Subversion (SVN) repository data. An attacker could potentially cause a denial-of-service (system slowdown or crash) by providing specially crafted SVN information. Note that this advisory was later withdrawn as the vulnerability could not be reliably reproduced, and popular tools like pytest have already removed their dependency on this library.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) located in the `py._path.svnurl.InfoSvnCommand.lspattern` regular expression. It is triggered when the library handles Subversion (SVN) projects with crafted 'info' data. An attacker can exploit this by providing a malicious SVN repository or data that causes the regex engine to consume excessive CPU resources, leading to a denial of service. Although originally assigned CVE-2022-42969, the advisory was withdrawn in August 2025 due to a lack of evidence for a valid, reproducible exploit. Pytest version 7.2.0 and later have removed the dependency on the affected 'py' library.

Affected products

• pytest-dev py <= 1.11.0

Timeline

• 2022-10-16: disclosed
• 2022-10-16: advisory
• 2025-08-01: other: Advisory withdrawn due to lack of reproducibility

References

• https://api.github.com/users/The-Compiler
• https://github.com/The-Compiler
• https://api.github.com/users/The-Compiler/gists%7B/gist_id%7D
• https://api.github.com/users/The-Compiler/repos
• https://avatars.githubusercontent.com/u/625793?v=4
• https://api.github.com/users/The-Compiler/events%7B/privacy%7D