GitPython Command Wrappers Omit Unsafe Protocol And Option Checks

Summary GitPython has spent 2022-2026 rolling out two reusable guards method-by-method: "Git.checkunsafeprotocolsurl" raises "UnsafeProtocolError" for "::" remote-helper URLs - CVE-2022-24439 and "Git.checkunsafeoptions..." raises "UnsafeOptionError" for denylisted option spellings -...

GitPython command wrappers omit unsafe protocol and option checks

Summary GitPython has spent 2022-2026 rolling out two reusable guards method-by-method: Git.checkunsafeprotocolsurl raises UnsafeProtocolError for :: remote-helper URLs - CVE-2022-24439 and Git.checkunsafeoptions... raises UnsafeOptionError for denylisted option spellings - CVE-2023-40267,...

GHSA-W8JC-G24H-CRHW GitPython command wrappers omit unsafe protocol and option checks

Summary GitPython has spent 2022-2026 rolling out two reusable guards method-by-method: Git.checkunsafeprotocolsurl raises UnsafeProtocolError for :: remote-helper URLs - CVE-2022-24439 and Git.checkunsafeoptions... raises UnsafeOptionError for denylisted option spellings - CVE-2023-40267,...

Improper Validation of Specified Type of Input

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via Git.lsremote forwarding caller-supplied URLs without checkunsafeprotocols validation. An attacker who controls the U...