econchick / econchick/interrogate
bug(security): the known vulnerability PYSEC-2022-42969 in the `py` dependency
- Dominant language
- Python
- Stars
- 676
- Forks
- 55
- PR merge metrics
- No merged PRs in 30d
Description
### 1. Summary
[**The dependency `py`**](https://github.com/econchick/interrogate/blob/f35a9d68f609d6ceed10f4286efc8d73b79b17cb/setup.py#L74) of Interrogate has the known vulnerability [**PYSEC-2022-42969**](https://osv.dev/vulnerability/PYSEC-2022-42969).
### 2. Steps to reproduce
I checked vulnerabilities of Interrogate use [**pip-audit**](https://github.com/pypa/pip-audit):
```shell
pipenv install --dev interrogate pip-audit
pipenv run pip-audit --aliases on --desc on --verbose
```
Result:
```text
Found 1 known vulnerability in 1 package
Name Version ID Fix Versions Aliases Description
---- ------- ---------------- ------------ ----------------------------------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
py 1.11.0 PYSEC-2022-42969 GHSA-w596-4wvx-j9j6, CVE-2022-42969 The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.
```
### 3. `py` status
[**`py` documentation**](https://github.com/pytest-dev/py):
> **NOTE**: this library is in **maintenance mode** and should not be used in new code.
[**The message from the developer of `py` from April 2023**](https://github.com/pytest-dev/py/issues/293#issuecomment-1506685334)
> Note that `py` is pretty much unmaintained at this point (see #288). You might want to find out why you're using it, and migrate away from it.
“[**Plan for dropping/deprecating submodules of `py` and releasing v2.0**](https://github.com/pytest-dev/py/issues/288)”:
> `py.io`
>
> Might want to raise deprecation warnings telling people to use `rich` or something.
It seems it would be nice if Interrogate will migrate from `py` to an actively maintained alternative.
Thanks.
Contributor guide
Assessment
This issue has not been assessed yet.