Inefficient regular expression complexity in EntryPoint.pattern

[jaraco]

BPO	46474
Nosy	@jaraco, @ambv
PRs	bpo-46474: sync with importlib_metadata 4.10.0 #30802 bpo-46474: Avoid REDoS in EntryPoint.pattern (sync with importlib_metadata 4.10.1) #30803 [3.10] bpo-46474: Avoid REDoS in EntryPoint.pattern (GH-30803) #30827 [3.9] bpo-46474: Avoid REDoS in EntryPoint.pattern (GH-30803). #30828 [3.8] bpo-46474: Avoid REDoS in EntryPoint.pattern (GH-30803). #30829

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/jaraco'
closed_at = <Date 2022-01-23.15:19:20.306>
created_at = <Date 2022-01-22.19:18:51.485>
labels = ['type-security', '3.8', '3.9', '3.10', '3.11', 'library']
title = 'Inefficient regular expression complexity in EntryPoint.pattern'
updated_at = <Date 2022-02-14.17:56:17.259>
user = 'https://github.com/jaraco'

bugs.python.org fields:

activity = <Date 2022-02-14.17:56:17.259>
actor = 'lukasz.langa'
assignee = 'jaraco'
closed = True
closed_date = <Date 2022-01-23.15:19:20.306>
closer = 'jaraco'
components = ['Library (Lib)']
creation = <Date 2022-01-22.19:18:51.485>
creator = 'jaraco'
dependencies = []
files = []
hgrepos = []
issue_num = 46474
keywords = ['patch']
message_count = 7.0
messages = ['411282', '411286', '411335', '411340', '411377', '411378', '413240']
nosy_count = 2.0
nosy_names = ['jaraco', 'lukasz.langa']
pr_nums = ['30802', '30803', '30827', '30828', '30829']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue46474'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']

[jaraco]

Originally reported to the Python Security Response Team, the EntryPoint.pattern demonstrates a potential ReDoS.

The issue has been patched and fix released with importlib_metadata 4.10.1. Let's get that fix incorporated into Python as well.