GoogleOSV:GHSA-HCPJ-QP55-GFPHGitPython vulnerable to Remote Code Execution due to improper user input validation
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.011 Low
EPSS
Percentile
84.2%
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
References
github.com/gitpython-developers/GitPython
github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py#L1249
github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py%23L1249
github.com/gitpython-developers/GitPython/commit/2625ed9fc074091c531c27ffcba7902771130261
github.com/gitpython-developers/GitPython/issues/1515
github.com/gitpython-developers/GitPython/releases/tag/3.1.30
lists.debian.org/debian-lts-announce/2023/07/msg00024.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X
lists.fedoraproject.org/archives/list/[email protected]/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH
lists.fedoraproject.org/archives/list/[email protected]/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN
lists.fedoraproject.org/archives/list/[email protected]/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R
lists.fedoraproject.org/archives/list/[email protected]/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X
nvd.nist.gov/vuln/detail/CVE-2022-24439
security.gentoo.org/glsa/202311-01
security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.011 Low
EPSS
Percentile
84.2%