Debian dla-4872 : python-git-doc - security update

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Debian Security Advisory dla-4872. The text
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('compat.inc');

if (description)
{
  script_id(374599);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/31");

  script_cve_id(
    "CVE-2026-42215",
    "CVE-2026-42284",
    "CVE-2026-44243",
    "CVE-2026-44244",
    "CVE-2026-67322",
    "CVE-2026-67323",
    "CVE-2026-67324",
    "CVE-2026-67325",
    "CVE-2026-67326",
    "CVE-2026-69097",
    "CVE-2026-73619",
    "CVE-2026-73620",
    "CVE-2026-73621",
    "CVE-2026-73622",
    "CVE-2026-73623",
    "CVE-2026-73624",
    "CVE-2026-73625",
    "CVE-2026-76217",
    "CVE-2026-76218",
    "CVE-2026-76219",
    "CVE-2026-76220",
    "CVE-2026-76221",
    "CVE-2026-76222",
    "CVE-2026-78675",
    "CVE-2026-78676",
    "CVE-2026-78677",
    "CVE-2026-78678",
    "CVE-2026-78679",
    "CVE-2026-87817",
    "CVE-2026-87818",
    "CVE-2026-87819",
    "CVE-2026-100689",
    "CVE-2026-110855",
    "CVE-2026-110856",
    "CVE-2026-110857",
    "CVE-2026-110858",
    "CVE-2026-110859",
    "CVE-2026-110860",
    "CVE-2026-114145"
  );

  script_name(english:"Debian dla-4872 : python-git-doc - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing one or more security-related updates.");
  script_set_attribute(attribute:"description", value:
"The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the
dla-4872 advisory.

    -------------------------------------------------------------------------
    Debian LTS Advisory DLA-4872-1                [email protected]
    https://www.debian.org/lts/security/                       Emmanuel Arias
    October 31, 2026                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-git
    Version        : 3.1.30-1+deb12u3
    CVE ID         : CVE-2026-42215 CVE-2026-42284 CVE-2026-44243 CVE-2026-44244
                     CVE-2026-67322 CVE-2026-67323 CVE-2026-67324 CVE-2026-67325
                     CVE-2026-67326 CVE-2026-69097 CVE-2026-73619 CVE-2026-73620
                     CVE-2026-73621 CVE-2026-73622 CVE-2026-73623 CVE-2026-73624
                     CVE-2026-73625 CVE-2026-76217 CVE-2026-76218 CVE-2026-76219
                     CVE-2026-76220 CVE-2026-76221 CVE-2026-76222 CVE-2026-78675
                     CVE-2026-78676 CVE-2026-78677 CVE-2026-78678 CVE-2026-78679
                     CVE-2026-87817 CVE-2026-87818 CVE-2026-87819 CVE-2026-100689
                     CVE-2026-110855 CVE-2026-110856 CVE-2026-110857 CVE-2026-110858
                     CVE-2026-110859 CVE-2026-110860 CVE-2026-114145
    Debian Bug     : 1135349 1135350 1143454 1143602 1144344 1144929

    Multiple security vulnerabilities were discovered in python-git
    (GitPython), a Python library used to interact with git repositories.
    These issues could result in arbitrary command execution, path traversal
    with arbitrary file read or write, git config injection, leaking of
    secrets through environment variable expansion or denial of service
    (ReDoS).

    CVE-2026-42215

        Unsafe options passed as underscored keyword arguments were not
        blocked, which could lead to command execution.

    CVE-2026-42284

        Unsafe options were not checked after splitting multi_options with
        shlex, which could lead to command execution.

    CVE-2026-44243

        When manipulating references, access to files outside the repository
        was not prevented, allowing arbitrary file access.

    CVE-2026-44244

        The config writer did not reject control characters in config values,
        allowing config injection.

    CVE-2026-67322

        Environment variables were expanded in clone URLs, which could leak
        secrets to a remote host.

    CVE-2026-67323

        Unsafe options (--exec, --upload-pack, ...) were not guarded in the
        archive, fetch, pull, push, ls-remote, blame and revision APIs, which
        could lead to command execution.

    CVE-2026-67324

        Abbreviated long options bypassed the unsafe option checks, leading to
        command execution.

    CVE-2026-67325

        Joined short options bypassed the unsafe option checks, leading to
        command execution.

    CVE-2026-67326

        Config section names were not validated before writing, allowing
        config injection.

    CVE-2026-69097

        Config section names containing an unquoted closing bracket could
        inject arbitrary settings into .git/config.

    CVE-2026-73619

        The --add-file, --add-virtual-file (archive) and --bundle-uri (clone)
        options were missing from the unsafe option lists, which could lead to
        command execution or arbitrary file access.

    CVE-2026-73620

        Unsafe options in IndexFile.checkout() (--prefix) and
        TagReference.create() (-F/--file) were not blocked, which could write
        to or read from arbitrary filesystem paths.

    CVE-2026-73621

        Unsafe output options were not rejected in Commit.count, which could
        write to arbitrary filesystem paths.

    CVE-2026-73622

        Environment variables were expanded in remote and submodule URLs,
        which could leak secrets to a remote host.

    CVE-2026-73623

        The unsafe --template option was not rejected when cloning, which
        could read from arbitrary filesystem paths.

    CVE-2026-73624

        Unsafe output options were not guarded in diff operations, which could
        write to arbitrary filesystem paths.

    CVE-2026-73625

        The values of split short options were not validated, which could
        bypass the unsafe option checks in clone, remote, revision, blame and
        archive operations.

    CVE-2026-76217

        The --pathspec-from-file options were not guarded in IndexFile.remove,
        Head.checkout and HEAD.reset, which could read from arbitrary
        filesystem paths.

    CVE-2026-76218

        Unsafe git init options (--template, --separate-git-dir) were not
        guarded in Repo.init, which could read from or write to arbitrary
        filesystem paths.

    CVE-2026-76219

        The --index-output option was not guarded in read-tree calls made by
        from_tree, merge_tree and reset, which could write to an arbitrary
        path.

    CVE-2026-76220

        The value joined to one-character options was not checked when
        split_single_char_options is false, which could bypass the unsafe
        option checks.

    CVE-2026-76221

        Config option names containing characters that could inject arbitrary
        settings when writing the config were not rejected.

    CVE-2026-76222

        Submodule names read from .gitmodules were not validated before
        filesystem operations, allowing path traversal outside the repository.

    CVE-2026-78675

        Include directives in .gitmodules were processed, which could read
        arbitrary files.

    CVE-2026-78676

        Multiline config values were not preserved when writing, which could
        inject new options into the config.

    CVE-2026-78677

        The --separate-git-dir option was not blocked in Repo.clone() and
        Repo.clone_from(), which could write repository metadata to an
        arbitrary path.

    CVE-2026-78678, CVE-2026-78679

        File-reading options were not blocked in blame, diff and tag APIs,
        which could read arbitrary files.

    CVE-2026-87817

        Repository discovery did not prefer the .git entry nor validate
        candidate git directories, diverging from git's behaviour.

    CVE-2026-87818

        The --no-index option was not treated as an unsafe diff option, which
        allowed diffing arbitrary filesystem paths.

    CVE-2026-87819

        Actor identities were parsed with regular expressions, allowing
        quadratic backtracking (ReDoS) on malformed identities.

    CVE-2026-100689

        Submodule checkout paths that resolve outside the repository or
        through a symbolic link were not rejected in Submodule.update, unlike
        in add and move.

    CVE-2026-110855

        Environment variables were expanded in the separate_git_dir path when
        cloning, so repository metadata could be written to an unexpected
        location.

    CVE-2026-110856

        Actor identities and dates in commit authors, committers and taggers
        were parsed with backtracking regular expressions, allowing excessive
        CPU use (ReDoS) on malformed metadata.

    CVE-2026-110857

        The unsafe option and protocol checks were incomplete in
        Git.ls_remote(), Repo.merge_base() and IndexFile.move(), which omitted
        guards already used by sibling APIs.

    CVE-2026-110858

        Option-shaped remote names were not rejected in Remote.update(), which
        git forwards to fetch --multiple without an option terminator,
        allowing a leading-dash name to change the requested operation.

    CVE-2026-110859

        The positional reference passed by Head.checkout() was not validated
        against the unsafe-option policy, so reference names originating in a
        cloned repository could bypass it.

    CVE-2026-110860

        Submodule checkout, move and metadata paths that traverse intermediate
        symbolic links were not rejected before performing filesystem
        operations.

    CVE-2026-114145

        GitPython validated a submodule's '.git' path only after cloning into
        it, which could lead to remote code execution.

    For Debian 12 bookworm, these problems have been fixed in version
    3.1.30-1+deb12u3.

    We recommend that you upgrade your python-git packages.

    For the detailed security status of python-git please refer to
    its security tracker page at:
    https://security-tracker.debian.org/tracker/python-git

    Further information about Debian LTS security advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://wiki.debian.org/LTS
    Attachment:
    signature.asc
    Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/source-package/python-git");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-100689");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-110855");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-110856");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-110857");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-110858");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-110859");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-110860");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-114145");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-42215");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-42284");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-44243");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-44244");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-67322");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-67323");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-67324");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-67325");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-67326");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-69097");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-73619");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-73620");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-73621");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-73622");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-73623");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-73624");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-73625");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-76217");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-76218");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-76219");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-76220");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-76221");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-76222");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-78675");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-78676");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-78677");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-78678");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-78679");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-87817");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-87818");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2026-87819");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/bookworm/python-git");
  script_set_attribute(attribute:"solution", value:
"Upgrade the python-git-doc packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-42284");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-78676");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python-git-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:python3-git");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);

var debian_release = get_kb_item('Host/Debian/release');
if ( isnull(debian_release) ) audit(AUDIT_OS_NOT, 'Debian');
debian_release = chomp(debian_release);
if (! preg(pattern:"^(12)\.[0-9]+", string:debian_release)) audit(AUDIT_OS_NOT, 'Debian 12.0', 'Debian ' + debian_release);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Debian', cpu);

var pkgs = [
    {'release': '12.0', 'prefix': 'python-git-doc', 'reference': '3.1.30-1+deb12u3'},
    {'release': '12.0', 'prefix': 'python3-git', 'reference': '3.1.30-1+deb12u3'}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var _release = NULL;
  var prefix = NULL;
  var reference = NULL;
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['prefix'])) prefix = package_array['prefix'];
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (_release && prefix && reference) {
    if (deb_check(release:_release, prefix:prefix, reference:reference)) flag++;
  }
}

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : deb_report_get()
  );
  exit(0);
}
else
{
  var tested = deb_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python-git-doc / python3-git');
}