GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
影響: pip:GitPython <= 3.1.62 → 3.2.0
This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor._from_string regex-free, but parse_actor_and_date still runs _re_actor_epoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epoch or timezone is missing or malformed, so the same class of slow parse is still reachable in 3.1.62. Details git/objects/util.py:322: python _re_actor_epoch = re.compile(r"^.+? (.) (\d+) ([+-]\d+).$") .+? and (.) can…
| 정보원 | GitHub Advisory Database |
|---|---|
| 수집 시각 | 2026. 10. 28. 오전 06:03 |
| 데이터 | Markdown JSON |
2026. 10. 28. 오전 12:26, GitHub Advisory Database에서 "GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python.