Most recent entries from all

bdu:2023-05150

BREW-checkov-CVE-2023-40267 — GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

Affected: Homebrew: checkov

GitPython before 3.1.32 does not block insecure non-multi options in `clone` and `clone_from`, making it vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

EUVD-2026-258459

fkie_cve-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

GHSA-pr76-5cm5-w9cj — GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

Affected: PyPI: GitPython

gsd-2023-40267

OESA-2023-1529 — python-GitPython security update

Affected: openEuler:20.03-LTS-SP1: python-GitPython, openEuler:20.03-LTS-SP3: python-GitPython, openEuler:22.03-LTS: python-GitPython, openEuler:22.03-LTS-SP1: python-GitPython, openEuler:22.03-LTS-SP2: python-GitPython

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing.

Security Fix(es):

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.(CVE-2022-24439)

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.(CVE-2023-40267)

openSUSE-SU-2024:13146-1 — python310-GitPython-3.1.32.1689011721.5d45ce2-1.1 on GA media

python310-GitPython-3.1.32.1689011721.5d45ce2-1.1 on GA media

PYSEC-2023-137

Affected: PyPI: gitpython

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

RHSA-2023:4971 — Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

python-cryptography: memory corruption via immutable objects GitPython: Insecure non-multi options in clone and clone_from is not blocked

UBUNTU-CVE-2023-40267

Affected: Ubuntu:Pro:14.04:LTS: python-git, Ubuntu:Pro:16.04:LTS: python-git, Ubuntu:Pro:18.04:LTS: python-git, Ubuntu:Pro:20.04:LTS: python-git, Ubuntu:Pro:22.04:LTS: python-git

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

WID-SEC-W-2023-2266 — Red Hat Ansible Automation Platform: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Code auszuführen oder falsche Informationen zu präsentieren.