PYSEC-2024-4

🗓️ 11 Jan 2024 02:15:00Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 5 Views

GitPython on Windows may run untrusted git or bash from a repo due to an incomplete CVE fix; upgrade to 3.1.41.

Reporter	Title	Published	Views	Family All 58
IBM Security Bulletins	Security Bulletin: QRadar Suite Software includes components with multiple known vulnerabilities	15 Feb 202413:10	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in GitPython affects IBM Process Mining CVE-2024-22190	29 Mar 202410:40	–	ibm
AlpineLinux	CVE-2023-40590	28 Aug 202317:24	–	alpinelinux
AlpineLinux	CVE-2024-22190	11 Jan 202401:23	–	alpinelinux
BDU FSTEC	The vulnerability of the Python library for interacting with git repositories, GitPython, allows a hacker to execute arbitrary commands.	5 Sep 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the use of an insecure search path, allowing attackers to execute arbitrary code with elevated privileges.	24 Jan 202400:00	–	bdu_fstec
Chainguard	CVE-2024-22190 vulnerabilities	11 Jan 202402:15	–	cgr
Circl	CVE-2023-40590	26 Aug 202307:04	–	circl
Circl	CVE-2024-22190	10 Jan 202412:17	–	circl
CNNVD	GitPython 代码问题漏洞	28 Aug 202300:00	–	cnnvd

Vulners

Node

Source	Link
github	www.github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx
github	www.github.com/gitpython-developers/GitPython/pull/1792
github	www.github.com/gitpython-developers/GitPython/pull/1792
github	www.github.com/gitpython-developers/GitPython/commit/ef3192cc414f2fd9978908454f6fd95243784c7f

18 Jan 2024 16:22Current

8.1High risk

Vulners AI Score8.1

CVSS 3.17.8

EPSS0.00465

SSVC