Remote Code Execution (RCE)

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Remote Code Execution RCE due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting...

Inefficient Regular Expression Complexity in gitpython-developers/gitpython

Description In the latest version of GitPython cd29f07b I discovered regular expression that is vulnerable to ReDoS Regular Expression Denial of Service Proof of Concept PoC based on code in git/remote.py Python import logging import re logging.basicConfigformat='%asctimes - %levelnames:...

Git-Vuln-Finder - Finding Potential Software Vulnerabilities From Git Commit Messages

Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE IDs are present,...

Leakage Of Environment Variables

gitPython is vulnerable to the leakage of environment variables. The leakage happens through error messages because it does not use the unsafe variable in the expandpath method. The unsafe variable should be set to False to prevent this. However, the variable is set to True by default...