sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2022-24439 +1 more via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2022-24439, CVE-2023-40267 Source advisory: OSV:PYSEC-2023-137...

codev (>=0.5.1a10, <=0.7.4a3), git-repo (1.6.0) potentially affected by CVE-2022-24439 +1 more via gitpython (2.0.2)

gitpython PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - codev =0.5.1a10, =0.7.4a3 - git-repo 1.6.0 Source cves: CVE-2022-24439, CVE-2023-40267 Source advisory: OSV:PYSEC-2023-137...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2022-24439 +1 more via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2022-24439, CVE-2023-40267 Source advisory: OSV:PYSEC-2023-137...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2022-24439 +1 more via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2022-24439, CVE-2023-40267 Source advisory:...

django-l10n-extensions (>=1.0.1, <=1.1.0), django-l10n-extensions-django-3 (1.0.7) +9 more potentially affected by CVE-2022-24439 +1 more via gitpython (1.0.1)

gitpython PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - django-l10n-extensions =1.0.1, =0.1.0, =0.1.0, =0.1.0.dev20160122122211, =0.3.0, =0.3.1, =0.1.0, =0.0.0, =0.1.2, =0.1.18 Source cves:...

gpopt (>=0.1.0, <=0.2.3) potentially affected by CVE-2022-24439 +1 more via gitpython (0.3.6)

gitpython PYPI version 0.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - gpopt =0.1.0, =0.2.3 Source cves: CVE-2022-24439, CVE-2023-40267 Source advisory: OSV:PYSEC-2023-137...

bento-cli (>=0.1.0, <=0.1.1), walletlib (0.1.0) potentially affected by CVE-2022-24439 +1 more via gitpython (2.1.14)

gitpython PYPI version 2.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bento-cli =0.1.0, =0.1.1 - walletlib 0.1.0 Source cves: CVE-2022-24439, CVE-2023-40267 Source advisory: OSV:PYSEC-2023-137...

PYSEC-2023-137

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

Code injection

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

CVE-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

CVE-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

CVE-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

GitPython Security Vulnerabilities

GitPython is a Python library for interacting with Git repositories open-sourced by gitpython-developers. A security vulnerability exists in GitPython versions prior to 3.1.32 that stems from not blocking the unsafe non-multi option in clone and clonefrom...

CVE-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

CVE-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

agixt (>=1.2.3, <=1.3.89), aicrowd-cli (>=0.1.8, <=0.1.15) +520 more potentially affected by CVE-2023-40267 via gitpython (>=0.3.4, <=3.1.31)

gitpython PYPI version =0.3.4, =1.2.3, =0.1.8, =0.5.0, =1.0.0, =1.0.1, =0.0.1, =2.0.1, =0.10.0.dev0, =0.0.1a0, =0.0.3, =6.1.3, =0.0.3rc1, =0.0.5 - apache-liminal-test-spark 0.0.0 and more Source cves: CVE-2023-40267 Source advisory: MEND:CVE-2023-40267...

CVE-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

CVE-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...

CVE-2023-40267

GitPython vulnerability CVE-2023-40267 affects versions before 3.1.32, where insecure non-multi options in clone and clone_from are not blocked. This arises as a follow-up to an incomplete fix for CVE-2022-24439. The issue enables Remote Code Execution via crafted or insecure remote URLs used in ...

Improper Input Validation

GitPython before 3.1.32 does not block insecure non-multi options in clone and clonefrom. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439...