CVE-2022-39280

Advisory

Dparse2 0.6.0 fixes a security issue related to Regex parsing.
https://github.com/pyupio/dparse/commit/3aecaac9a1bde349418810a320a7e5ec31ee276a

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------

* Fork from upstream dparse that is unresponsive
* Rename package to dparse2
* Fix security issue for GHSL-2021-111https://github.com/pyupio/dparse/issues/50
* Drop support for Python < 3.6 and add support for up to 3.10
* Drop support for updating requirements files
* format code with black, sort imports

Resources

• https://pypi.org/project/dparse2
• https://pyup.io/changelogs/dparse2/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39280
• https://github.com/pyupio/dparse/commit/8c990170bbd6c0cf212f1151e9025486556062d5
• https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
• https://github.com/pyupio/dparse/commit/d87364f9db9ab916451b1b036cfeb039e726e614
• https://github.com/pyupio/dparse/security/advisories/GHSA-8fg9-p83m-x5pq