GitPython: Blind local file inclusion

🗓️ 16 Jan 2024 14:36:37Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 3 Views

GitPython path traversal in .git reading may allow local file access or denial of service.

Reporter	Title	Published	Views	Family All 77
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management	28 Feb 202421:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2023	25 Oct 202320:07	–	ibm
AlpineLinux	CVE-2023-41040	30 Aug 202321:07	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in python-git	20 May 202605:53	–	astralinux
BDU FSTEC	The vulnerability of the symbolic.py component in the Python library for interacting with Git repositories in GitPython allows a malicious individual to gain unauthorized access to protected information or cause service failures.	12 Sep 202300:00	–	bdu_fstec
Circl	CVE-2023-41040	26 Aug 202307:04	–	circl
CNNVD	GitPython 路径遍历漏洞	30 Aug 202300:00	–	cnnvd
CVE	CVE-2023-41040	30 Aug 202321:07	–	cve
Cvelist	CVE-2023-41040 GitPython blind local file inclusion	30 Aug 202321:07	–	cvelist
Debian	[SECURITY] [DLA 3589-1] python-git security update	29 Sep 202318:06	–	debian

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	python3-gitpython	3.1.14-2.el8ost	python3-gitpython-3.1.14-2.el8ost.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2023-41040
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-41040
cve	www.cve.org/CVERecord

02 Jun 2026 15:05Current

7.2High risk

Vulners AI Score7.2

CVSS 3.14 - 6.5

EPSS0.01021

SSVC

gitpython path traversal local file inclusion dot git directory security vulnerability denial of service