PT-2020-17233 · Python+4 · Py+4

Published 2020-09-03 · Updated 2025-11-03 · CVE-2020-29651

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions py versions through 1.9.0

Description A denial of service via regular expression in the py.path.svnwc component could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.

Recommendations For versions through 1.9.0, update to a version later than 1.9.0 to resolve the issue. As a temporary workaround, consider restricting the input to the blame functionality to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-185

CWE-400

Related Identifiers

BDU:2025-03934

CVE-2020-29651

DLA-3966-1

GHSA-HJ5V-574P-MJ7C

MGASA-2021-0071

OESA-2022-1562

OPENSUSE-SU-2021:0851-1

OPENSUSE-SU-2021:1859-1

OPENSUSE-SU-2021_0851-1

OPENSUSE-SU-2021_1859-1

OPENSUSE-SU-2022_2831-1

OPENSUSE-SU-2024:11108-1

OPENSUSE-SU-2024:11252-1

OPENSUSE-SU-2024:14153-1

PYSEC-2020-92

SUSE-FU-2022:0444-1

SUSE-FU-2022:0445-1

SUSE-SU-2021:1859-1

SUSE-SU-2021:1962-1

SUSE-SU-2021:1963-1

SUSE-SU-2021:2236-1

SUSE-SU-2021:2554-1

SUSE-SU-2021_1859-1

SUSE-SU-2021_2236-1

SUSE-SU-2022:2831-1

SUSE-SU-2022_2831-1

USN-5138-1

Affected Products

Astra Linux

Linuxmint

Suse

Ubuntu

Py

References · 145

• https://github.com/pytest-dev/py/pull/257/commits/4a9017dc6199d2a564b6e4b0aa39d6d8870e4144 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-29651 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5138-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14153-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1859-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-29651 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-0422SE64 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0071 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1859-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHDTINIBJZ67T3W74QTBIY5LPKAXEOGR · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYWNYEV3FGDHPIHX4DDUDMFZ6NLCQRC4 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5138-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/CHDTINIBJZ67T3W74QTBIY5LPKAXEOGR · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/681990 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:2554-1 · Vendor Advisory