Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-29651

CVE-2020-29651: py vulnerable to Regular Expression Denial of Service

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-29651
GHSA ID
GHSA-hj5v-574p-mj7c
EPSS Score
0.73893%
CWE
CWE-400
Published
4/20/2021
Updated
10/21/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
pypip< 1.10.01.10.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability was explicitly traced to a regex pattern in py.path.svnwc component through GitHub issues (#256) and the fix in commit 4a9017d. The regex '\s*(\d+)\s*(\S+) (.)' was modified to '\s(\d+)\s+(\S+) (.*)' to prevent ambiguous matching. This regex is directly tied to the blame functionality's output parsing logic in svnwc.py, making it the clear vulnerable element.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* **ni*l o* s*rvi** vi* r**ul*r *xpr*ssion in t** py.p*t*.svnw* *ompon*nt o* py (*k* pyt*on-py) t*rou** *.*.* *oul* ** us** *y *tt**k*rs to **us* * *omput*-tim* **ni*l o* s*rvi** *tt**k *y supplyin* m*li*ious input to t** *l*m* *un*tion*lity.

Reasoning

T** vuln*r**ility w*s *xpli*itly tr**** to * r***x p*tt*rn in py.p*t*.svnw* *ompon*nt t*rou** *it*u* issu*s (#***) *n* t** *ix in *ommit *******. T** r***x '\s*(\*+)\s*(\S+) (.*)' w*s mo*i*i** to '\s*(\*+)\s+(\S+) (.*)' to pr*v*nt *m*i*uous m*t**in*.