Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GitPython vulnerabilities (USN-8303-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-8303-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##

include('compat.inc');

if (description)
{
  script_id(317096);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/27");

  script_cve_id(
    "CVE-2023-41040",
    "CVE-2026-42215",
    "CVE-2026-42284",
    "CVE-2026-44243",
    "CVE-2026-44244"
  );
  script_xref(name:"USN", value:"8303-1");

  script_name(english:"Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GitPython vulnerabilities (USN-8303-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages
installed that are affected by multiple vulnerabilities as referenced in the USN-8303-1 advisory.

    Santos Gallegos discovered that GitPython did not properly validate paths when resolving certain Git
    references. An attacker could possibly use this issue to cause files outside the .git directory to be
    accessed, leading to a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
    Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-41040)

    Wes Ring discovered that GitPython did not properly block certain unsafe Git options when they were
    provided as Python keyword arguments. An attacker could possibly use this issue to cause arbitrary command
    execution. (CVE-2026-42215)

    It was discovered that GitPython did not properly validate clone options before processing them. An
    attacker could possibly use this issue to inject unsafe Git configuration, leading to arbitrary command
    execution through Git hooks. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04
    LTS, and Ubuntu 26.04 LTS. (CVE-2026-42284)

    It was discovered that GitPython did not properly validate reference paths during reference operations. An
    attacker could possibly use this issue to write, overwrite, move, or delete files outside the repository.
    (CVE-2026-44243)

    Dan Aridor discovered that GitPython did not properly validate configuration values before writing them to
    Git configuration files. An attacker could possibly use this issue to inject unsafe Git configuration,
    leading to arbitrary command execution through Git hooks. (CVE-2026-44244)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-8303-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected python-git and / or python3-git packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-42284");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-44243");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/08/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:26.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python-git");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:python3-git");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2026 Canonical, Inc. / NASL script (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "ubuntu_pro_sub_detect.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('14.04' >< os_release || '16.04' >< os_release || '18.04' >< os_release || '20.04' >< os_release || '22.04' >< os_release || '24.04' >< os_release || '26.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 14.04 / 16.04 / 18.04 / 20.04 / 22.04 / 24.04 / 26.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);
var ubuntu_pro_detected = get_kb_item('Host/Ubuntu/Pro/Services/esm-apps');
ubuntu_pro_detected = !empty_or_null(ubuntu_pro_detected);

var pro_caveat_needed = FALSE;

var pkgs = [
    {'osver': '14.04', 'pkgname': 'python-git', 'pkgver': '0.3.2~RC1-3ubuntu0.1~esm3', 'ubuntu_pro': TRUE, 'cves': ['CVE-2023-41040', 'CVE-2026-42215', 'CVE-2026-44243', 'CVE-2026-44244']},
    {'osver': '16.04', 'pkgname': 'python-git', 'pkgver': '1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4', 'ubuntu_pro': TRUE, 'cves': ['CVE-2023-41040', 'CVE-2026-42215', 'CVE-2026-44243', 'CVE-2026-44244']},
    {'osver': '16.04', 'pkgname': 'python3-git', 'pkgver': '1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4', 'ubuntu_pro': TRUE, 'cves': ['CVE-2023-41040', 'CVE-2026-42215', 'CVE-2026-44243', 'CVE-2026-44244']},
    {'osver': '18.04', 'pkgname': 'python-git', 'pkgver': '2.1.8-1ubuntu0.1~esm4', 'ubuntu_pro': TRUE, 'cves': ['CVE-2023-41040', 'CVE-2026-42215', 'CVE-2026-44243', 'CVE-2026-44244']},
    {'osver': '18.04', 'pkgname': 'python3-git', 'pkgver': '2.1.8-1ubuntu0.1~esm4', 'ubuntu_pro': TRUE, 'cves': ['CVE-2023-41040', 'CVE-2026-42215', 'CVE-2026-44243', 'CVE-2026-44244']},
    {'osver': '20.04', 'pkgname': 'python3-git', 'pkgver': '3.0.7-1ubuntu0.1~esm4', 'ubuntu_pro': TRUE, 'cves': ['CVE-2023-41040', 'CVE-2026-42215', 'CVE-2026-42284', 'CVE-2026-44243', 'CVE-2026-44244']},
    {'osver': '22.04', 'pkgname': 'python3-git', 'pkgver': '3.1.24-1ubuntu0.1~esm3', 'ubuntu_pro': TRUE, 'cves': ['CVE-2023-41040', 'CVE-2026-42215', 'CVE-2026-42284', 'CVE-2026-44243', 'CVE-2026-44244']},
    {'osver': '24.04', 'pkgname': 'python3-git', 'pkgver': '3.1.37-3ubuntu0.1~esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2026-42215', 'CVE-2026-42284', 'CVE-2026-44243', 'CVE-2026-44244']},
    {'osver': '26.04', 'pkgname': 'python3-git', 'pkgver': '3.1.46-1ubuntu0.1~esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2026-42215', 'CVE-2026-42284', 'CVE-2026-44243', 'CVE-2026-44244']}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  var pro_required = NULL;
  if (!empty_or_null(package_array['ubuntu_pro'])) pro_required = package_array['ubuntu_pro'];
  if (osver && pkgname && pkgver) {
    if (deb_check(release:osver, prefix:pkgname, reference:pkgver, cves:cves)) {
        flag++;
        if (!ubuntu_pro_detected && !pro_caveat_needed) pro_caveat_needed = pro_required;
    }
  }
}

if (flag)
{
  var extra = '';
  if (pro_caveat_needed) {
    extra += 'NOTE: This vulnerability check contains fixes that apply to packages only \n';
    extra += 'available in Ubuntu ESM repositories. Access to these package security updates \n';
    extra += 'require an Ubuntu Pro subscription.\n\n';
  }
  extra += ubuntu_report_get();
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : extra
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'python-git / python3-git');
}