openSUSE Patches Two Denial of Service Flaws in Python py Library on Tumbleweed
openSUSE has issued advisory openSUSE-SU-2026:12027-1, rated moderate, covering two vulnerabilities fixed in the py Python library as shipped on the GA media of openSUSE Tumbleweed. The affected packages are python313-py and python314-py, both at version 1.11.0-9.5. The advisory cross-references CVE-2020-29651, which SUSE scores 5.5, and CVE-2022-42969, scored 6.5. Only openSUSE Tumbleweed is listed as an affected product, so organisations running Tumbleweed workstations, build hosts or container images that pull the distribution's Python 3.13 or 3.14 stacks fall in scope.
The advisory itself does not publish exploitation details for either issue, and no proof-of-concept or attack chain is described. What the published scoring does convey is the shape of each flaw. CVE-2020-29651 carries the vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, meaning a local, low-complexity issue that needs no privileges but does require a user to act, with the entire impact falling on availability. CVE-2022-42969 carries AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, the same availability-only outcome but reachable over the network. Neither vector indicates any loss of confidentiality or integrity.
The py library is rarely installed deliberately and usually arrives as a transitive dependency of test and build tooling, which is why one fix lands across two Python runtimes at once. The realistic worst case here is a hang or crash rather than data theft or code execution, so the operational concern is build pipeline and service uptime. On current exploitation status, FIRST EPSS puts CVE-2020-29651 at a 4.7 percent probability of exploitation in the next thirty days and CVE-2022-42969 at 2.1 percent, with no confirmed in-the-wild activity recorded for either.
Attack Surface
Endpoint OS, Server OS, Supply Chain (Third-party vendors)
Tactics
Impact
Techniques
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Install the fixed packages on openSUSE Tumbleweed by running 'zypper refresh && zypper update python313-py python314-py' so both land at version 1.11.0-9.5, which is the build named in openSUSE-SU-2026:12027-1.
- Inventory affected hosts with 'rpm -q python313-py python314-py' and flag any system reporting a release older than 1.11.0-9.5 for scheduling into the next Tumbleweed maintenance window.
- Check Python virtual environments separately with 'pip list | grep -i "^py "', because a pip-installed copy of the py library is not replaced by the zypper package update and will still carry CVE-2020-29651 and CVE-2022-42969.
- Where py exists only as a leftover transitive dependency of older pytest pins, remove it with 'pip uninstall py' after confirming no code imports the 'py.' namespace, which eliminates the exposure rather than deferring it to the next advisory.
- Rebuild container images and CI build agents that are layered on openSUSE Tumbleweed GA media so the baked-in python313-py and python314-py layers are refreshed to 1.11.0-9.5, then verify with 'zypper –no-refresh lu' in the image build step.
- Alert on CI and application worker processes that import py and then pin a CPU core at sustained high utilisation or stop responding, since both CVEs in this advisory are scored A:H with no confidentiality or integrity impact and will present as a hang or crash.
