GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.
Weakness
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitpython | Gitpython_project | * | 3.1.60 (excluding) |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | RedHat | python3.12-gitpython-0:3.1.60-1.el8ap | * |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | RedHat | python3.12-gitpython-0:3.1.60-1.el9ap | * |
| Red Hat Ansible Automation Platform 2.6 for RHEL 9 | RedHat | python3.12-gitpython-0:3.1.60-1.el9ap | * |
| Red Hat OpenShift AI 2.25 | RedHat | rhoai/odh-feature-server-rhel9:1792148523 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-feature-server-rhel9:1791863220 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-mlflow-rhel9:1791865967 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-th06-cpu-torch210-py312-rhel9:1791874335 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-th06-cuda130-torch210-py312-rhel9:1791961113 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-th06-rocm64-torch291-py312-rhel9:1791872119 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-training-cuda128-torch29-py312-rhel9:1791786619 | * |
| Red Hat OpenShift AI 3.4 | RedHat | rhoai/odh-trustyai-nemo-guardrails-server-rhel9:1791556128 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-mlflow-rhel9:1791947857 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9:1791952873 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1791816462 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9:1791816487 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9:1791951049 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9:1791951047 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9:1791950760 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-th-torch-cpu-py312-rhel9:1791926611 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-th-torch-cuda-py312-rhel9:1791927642 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-th-torch-rocm-py312-rhel9:1791925861 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-training-cuda128-torch29-py312-rhel9:1791927231 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1791825469 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:1791903880 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9:1791572098 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9:1791572144 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9:1791572102 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:1791817064 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9:1791817844 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:1791816223 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9:1791899290 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9:1791816175 | * |
| Red Hat OpenShift AI 3.5 | RedHat | rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:1791816316 | * |
| Python-git | Ubuntu | upstream | * |