Threats tagged 'ghsa-m64x-33q8-m5h7'

GitPython versions prior to 3.2.0 contain a vulnerability in the parse_actor_and_date() function due to a regex pattern that causes quadratic backtracking on malformed author, committer, or tagger identity lines. This results in CPU exhaustion when processing crafted commit or tag objects with malformed identity lines lacking valid epoch or timezone information. The issue was fixed in version 3.2.0 by modifying the regex to prevent overlapping matches and eliminate the backtracking.