econchick / econchick/interrogate

bug(security): the known vulnerability PYSEC-2022-42969 in the `py` dependency

Open
#185 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
676
Forks
55
PR merge metrics
No merged PRs in 30d

Description

### 1. Summary

[**The dependency `py`**](https://github.com/econchick/interrogate/blob/f35a9d68f609d6ceed10f4286efc8d73b79b17cb/setup.py#L74) of Interrogate has the known vulnerability [**PYSEC-2022-42969**](https://osv.dev/vulnerability/PYSEC-2022-42969).

### 2. Steps to reproduce

I checked vulnerabilities of Interrogate use [**pip-audit**](https://github.com/pypa/pip-audit):

```shell
pipenv install --dev interrogate pip-audit

pipenv run pip-audit --aliases on --desc on --verbose
```

Result:

```text
Found 1 known vulnerability in 1 package
Name Version ID Fix Versions Aliases Description
---- ------- ---------------- ------------ ----------------------------------- ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
py 1.11.0 PYSEC-2022-42969 GHSA-w596-4wvx-j9j6, CVE-2022-42969 The py library through 1.11.0 for Python allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data, because the InfoSvnCommand argument is mishandled.
```

### 3. `py` status

[**`py` documentation**](https://github.com/pytest-dev/py):

> **NOTE**: this library is in **maintenance mode** and should not be used in new code.

[**The message from the developer of `py` from April 2023**](https://github.com/pytest-dev/py/issues/293#issuecomment-1506685334)

> Note that `py` is pretty much unmaintained at this point (see #288). You might want to find out why you're using it, and migrate away from it.

“[**Plan for dropping/deprecating submodules of `py` and releasing v2.0**](https://github.com/pytest-dev/py/issues/288)”:

> `py.io`
>
> Might want to raise deprecation warnings telling people to use `rich` or something.

It seems it would be nice if Interrogate will migrate from `py` to an actively maintained alternative.

Thanks.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.