Skip to content
OpenAdvisories
High USN-5138-1 1 CVE

python-py vulnerability

Published Nov 10, 2021 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

The py.path.svnwc component of py (aka python-py) through v1.9.0 contains
a regular expression with an ambiguous subpattern that is susceptible to
catastrophic backtracing. This could be used by attackers to cause a compute-time
denial of service attack by supplying malicious input to the blame functionality.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS python-py 1.5.2-1ubuntu0.1
Ubuntu · 20.04 LTS 20.04:LTS python-py 1.8.1-1ubuntu0.1

Vulnerabilities 1

  • High 7.5
    CVE-2020-29651

    py vulnerable to Regular Expression Denial of Service

    A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.

    python-py py python-py Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-29651