PT-2022-7372

Name of the Vulnerable Software and Affected Versions gitpython versions affected versions not specified Description The issue is related to improper user input validation in the gitpython library, which allows for Remote Code Execution RCE due to insufficient sanitization of input arguments when...

GitPython input validation vulnerability

GitPython is a Python library for interacting with Git repositories open-sourced by gitpython-developers. A security vulnerability exists in GitPython that stems from incorrect user input validation and can be exploited by an attacker to remotely execute code...

aicrowd-cli (>=0.1.8, <=0.1.15), aim-cli (>=1.0.0, <=1.2.7rc4) +456 more potentially affected by CVE-2022-24439 via gitpython (>=0.3.4, <=3.1.29)

gitpython PYPI version =0.3.4, =0.1.8, =1.0.0, =1.0.1, =2.0.1, =0.10.0.dev0, =0.0.1a0, =0.0.3, =6.1.3, =0.0.3rc1, =0.0.0, =0.1.0a0, =0.1.0, =0.1.1 and more Source cves: CVE-2022-24439 Source advisory: SNYK:PYTHON-GITPYTHON-3113858...

Remote Code Execution (RCE)

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Remote Code Execution RCE due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting...

Inefficient Regular Expression Complexity in gitpython-developers/gitpython

Description In the latest version of GitPython cd29f07b I discovered regular expression that is vulnerable to ReDoS Regular Expression Denial of Service Proof of Concept PoC based on code in git/remote.py Python import logging import re logging.basicConfigformat='%asctimes - %levelnames:...

Leakage Of Environment Variables

gitPython is vulnerable to the leakage of environment variables. The leakage happens through error messages because it does not use the unsafe variable in the expandpath method. The unsafe variable should be set to False to prevent this. However, the variable is set to True by default...