GitPython Insecure Search Path Code Execution

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the use of an unreliable search path. Exploiting this vulnerability allows a attacker to execute arbitrary code with elevated privileges using a specially created binary file...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

GitPython: Blind local file inclusion

A path traversal vulnerability was found in GitPython due to an input validation error when reading from the ".git" directory. This issue may allow a remote attacker to prepare a specially crafted ".git" file with directory traversal characters in file names and force the application to read thes...

GitPython: Blind local file inclusion

A path traversal vulnerability was found in GitPython due to an input validation error when reading from the ".git" directory. This issue may allow a remote attacker to prepare a specially crafted ".git" file with directory traversal characters in file names and force the application to read thes...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (GitPython) security update

An update for GitPython is now available for Red Hat OpenStack Platform 17.1 Wallaby. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

GitPython: Blind local file inclusion

A path traversal vulnerability was found in GitPython due to an input validation error when reading from the ".git" directory. This issue may allow a remote attacker to prepare a specially crafted ".git" file with directory traversal characters in file names and force the application to read thes...

RHEL 9 : Red Hat OpenStack Platform 17.1 (GitPython) (RHSA-2024:0215)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0215 advisory. GitPython is a python library used to interact with Git repositories. Security Fixes: Blind local file inclusion CVE-2023-41040 For more details abou...

SUSE CVE-2024-22190

GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run git, as well as when it runs bash.exe to interpret hooks. If either of those features are used on...

Arbitrary Code Execution

gitpython is vulnerable to Arbitrary Code Execution. The vulnerability is due to an untrusted shell search path used to run the git executable, as well as when it runs bash.exe to interpret hooks. If either of these is used, a malicious .exe file may be executed from an untrusted repository...

CVE-2024-22190

GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run git, as well as when it runs bash.exe to interpret hooks. If either of those features are used on...

bento-cli (>=0.1.0, <=0.1.1), walletlib (0.1.0) potentially affected by CVE-2023-40590 +1 more via gitpython (2.1.14)

gitpython PYPI version 2.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bento-cli =0.1.0, =0.1.1 - walletlib 0.1.0 Source cves: CVE-2023-40590, CVE-2024-22190 Source advisory: OSV:PYSEC-2024-4...

arca (>=0.1.0a0, <=0.1.0), mali (>=0.2775.0, <=0.4018.0) +4 more potentially affected by CVE-2023-40590 +1 more via gitpython (2.1.7)

gitpython PYPI version 2.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.0a0, =0.2775.0, =0.2304.0, =0.2304.0, =0.1.0a1, =1.0.0, =1.0.6 Source cves: CVE-2023-40590, CVE-2024-22190 Source advisory:...

git-semver (>=0.1.2, <=0.1.5) potentially affected by CVE-2023-40590 +1 more via gitpython (2.0.9)

gitpython PYPI version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - git-semver =0.1.2, =0.1.5 Source cves: CVE-2023-40590, CVE-2024-22190 Source advisory: OSV:PYSEC-2024-4...

elib (>=0.1.55, <=0.1.57), emiz (>=0.1.35, <=2018.4.2.1) +11 more potentially affected by CVE-2023-40590 +1 more via gitpython (2.1.8)

gitpython PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - elib =0.1.55, =0.1.35, =0.2.4a149, =0.0.1, =1.0.0, =0.4233.0, =0.2354.0, =0.2354.0, =0.1.7, =0.2.120, =1.0.0, =0.1.0, =2.1.1 Source cves:...

Design/Logic Flaw

GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run git, as well as when it runs bash.exe to interpret hooks. If either of those features are used on...

CVE-2024-22190

GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run git, as well as when it runs bash.exe to interpret hooks. If either of those features are used on...

freedom (>=0.0.0_21_g3038804_dirty, <=0.0.1) potentially affected by CVE-2023-40590 +1 more via gitpython (0.3.4)

gitpython PYPI version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - freedom =0.0.021g3038804dirty, =0.0.1 Source cves: CVE-2023-40590, CVE-2024-22190 Source advisory: OSV:PYSEC-2024-4...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2023-40590 +1 more via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2023-40590, CVE-2024-22190 Source advisory: OSV:PYSEC-2024-4...

agixt (>=1.2.3, <=1.3.155), aicrowd-cli (>=0.1.8, <=0.1.15) +437 more potentially affected by CVE-2023-40590 +1 more via gitpython (>=3.0.0, <=3.1.40)

gitpython PYPI version =3.0.0, =1.2.3, =0.1.8, =0.5.0, =1.0.0, =0.0.1, =2.0.1, =0.10.0.dev0, =0.0.1a0, =0.0.1b0, =6.1.3, =0.0.3rc1, =0.0.0, =0.53.0, =0.53.10 and more Source cves: CVE-2023-40590, CVE-2024-22190 Source advisory: OSV:PYSEC-2024-4...

PYSEC-2024-4

GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run git, as well as when it runs bash.exe to interpret hooks. If either of those features are used on...