[GHSA-w596-4wvx-j9j6] ReDoS in py library

[The-Compiler]

Updates

• Affected products
• Description

Comments
pytest-dev/py#287 (comment)

[advisory-database]

Hi @The-Compiler! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[darakian]

Hey there @The-Compiler 👋

I'm sorry for your situation. Sadly people getting CVEs assigned on open issues is not an uncommon occurrence 😞
I've reworded your description update a bit and tried to make the advisory a little richer to aid anyone reading it. I've also added the codepath to the advisory so that dependabot can more intelligently target alerts.

Again sorry for the situation and thank you for reaching out :)

[The-Compiler]

Thanks @darakian! This is very helpful and much appreciated.

Is there any process to get this kind of amendment back into CVE-2022-42969 as well? That would in addition help people outside of the GitHub ecosystem to accurately judge the (non-)severity of this issue for them.

[darakian]

Happy to help! 👍
Updating the root CVE is a harder pull. We don't have any control of that so, you'll need to get in contact with the assigning CNA (mitre in this case) and request the change on their end.
https://cve.mitre.org/about/contactus.html