GHSA-P538-C434-8V24 GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count

Summary Commit.count forwards kwargs into revlist with no checkunsafeoptions guard the guard exists only in the sibling iteritems, commit.py:341. git rev-list --output= opens and truncates the target file to 0 bytes before revision parsing, so countoutput='/victim' destroys/blanks an arbitrary...

Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the Commit.count function. An attacker can cause arbitrary files to be truncated to zero bytes by injecting the output argument, leadi...

GitLab Access Control Error Vulnerability (CNVD-2020-01235)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An access control error vulnerability exists in GitLab,...