mrx-link (>=0.8.2, <=1.2.0), mrx-link-core (>=1.2.0.dev1, <=1.3.2.dev1) +1 more potentially affected by CVE-2023-40170 via jupyter-server (1.17.0)

jupyter-server PYPI version 1.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - mrx-link =0.8.2, =1.2.0.dev1, =0.12.0.dev0, =1.0.2.dev1 Source cves: CVE-2023-40170 Source advisory: OSV:GHSA-64X5-55RW-9974...

aws-client (>=0.10.0, <=0.11.0), git-repo (>=1.7.0, <=1.7.1) potentially affected by CVE-2023-40590 via gitpython (2.0.6)

gitpython PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - aws-client =0.10.0, =1.7.0, =1.7.1 Source cves: CVE-2023-40590 Source advisory: OSV:GHSA-WFM5-V35H-VWF4...

git-semver (>=0.1.2, <=0.1.5) potentially affected by CVE-2023-40590 via gitpython (2.0.9)

gitpython PYPI version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - git-semver =0.1.2, =0.1.5 Source cves: CVE-2023-40590 Source advisory: OSV:GHSA-WFM5-V35H-VWF4...

codev (>=0.5.1a10, <=0.7.4a3), git-repo (1.6.0) potentially affected by CVE-2023-40590 via gitpython (2.0.2)

gitpython PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - codev =0.5.1a10, =0.7.4a3 - git-repo 1.6.0 Source cves: CVE-2023-40590 Source advisory: OSV:GHSA-WFM5-V35H-VWF4...

GHSA-WFM5-V35H-VWF4 GitPython untrusted search path on Windows systems leading to arbitrary code execution

Summary When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment see big warning in https://docs.python.org/3/library/subprocess.htmlpopen-constructor. GitPython defaults to use the git command, if a user runs GitPython from a repo has a...

elib (>=0.1.55, <=0.1.57), emiz (>=0.1.35, <=2018.4.2.1) +11 more potentially affected by CVE-2023-40590 via gitpython (2.1.8)

gitpython PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - elib =0.1.55, =0.1.35, =0.2.4a149, =0.0.1, =1.0.0, =0.4233.0, =0.2354.0, =0.2354.0, =0.1.7, =0.2.120, =1.0.0, =0.1.0, =2.1.1 Source cves:...

django-l10n-extensions (>=1.0.1, <=1.1.0), django-l10n-extensions-django-3 (1.0.7) +9 more potentially affected by CVE-2023-40590 via gitpython (1.0.1)

gitpython PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - django-l10n-extensions =1.0.1, =0.1.0, =0.1.0, =0.1.0.dev20160122122211, =0.3.0, =0.3.1, =0.1.0, =0.0.0, =0.1.2, =0.1.18 Source cves:...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2023-40590 via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2023-40590 Source advisory: OSV:GHSA-WFM5-V35H-VWF4...

CVE-2023-40590

A flaw was found in Python/Windows. When resolving a program, it looks for the current working directory followed by the PATH environment. GitPython defaults to use the git command if a user runs GitPython from a repo, has a git.exe, or git executable, that program will run instead of the one in...

mrx-link (>=0.8.2, <=1.2.0), mrx-link-core (>=1.2.0.dev1, <=1.3.2.dev1) +1 more potentially affected by CVE-2023-39968 via jupyter-server (1.17.0)

jupyter-server PYPI version 1.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - mrx-link =0.8.2, =1.2.0.dev1, =0.12.0.dev0, =1.0.2.dev1 Source cves: CVE-2023-39968 Source advisory: OSV:PYSEC-2023-155...

mrx-link (>=0.8.2, <=1.2.0), mrx-link-core (>=1.2.0.dev1, <=1.3.2.dev1) +1 more potentially affected by CVE-2023-40170 via jupyter-server (1.17.0)

jupyter-server PYPI version 1.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - mrx-link =0.8.2, =1.2.0.dev1, =0.12.0.dev0, =1.0.2.dev1 Source cves: CVE-2023-40170 Source advisory: OSV:PYSEC-2023-157...

dcos (>=0.1.1, <=0.4.10), dcoscli (>=0.1.1, <=0.4.10) +5 more potentially affected by CVE-2023-40590 via gitpython (1.0.2)

gitpython PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - dcos =0.1.1, =0.1.1, =1.2.0, =0.1.0, =1.0.1, =24.0.0, =24.3.1, =25.0.2 Source cves: CVE-2023-40590 Source advisory: OSV:PYSEC-2023-161...

codev (>=0.5.1a10, <=0.7.4a3), git-repo (1.6.0) potentially affected by CVE-2023-40590 via gitpython (2.0.2)

gitpython PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - codev =0.5.1a10, =0.7.4a3 - git-repo 1.6.0 Source cves: CVE-2023-40590 Source advisory: OSV:PYSEC-2023-161...

PYSEC-2023-161

GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the git command, if a user runs GitPython from a repo has a git.exe or git...

CVE-2023-40590

GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the git command, if a user runs GitPython from a repo has a git.exe or git...

PYSEC-2023-161

GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the git command, if a user runs GitPython from a repo has a git.exe or git...

UBUNTU-CVE-2023-40590

GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the git command, if a user runs GitPython from a repo has a git.exe or git...

aws-client (>=0.10.0, <=0.11.0), git-repo (>=1.7.0, <=1.7.1) potentially affected by CVE-2023-40590 via gitpython (2.0.6)

gitpython PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - aws-client =0.10.0, =1.7.0, =1.7.1 Source cves: CVE-2023-40590 Source advisory: OSV:PYSEC-2023-161...

git-semver (>=0.1.2, <=0.1.5) potentially affected by CVE-2023-40590 via gitpython (2.0.9)

gitpython PYPI version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - git-semver =0.1.2, =0.1.5 Source cves: CVE-2023-40590 Source advisory: OSV:PYSEC-2023-161...

CVE-2023-40590

GitPython (CVE-2023-40590) on Windows can execute a malicious git.exe/git in the current repository when GitPython runs git via a shell or when hooks use bash.exe, enabling arbitrary code execution. A patch exists: GitPython 3.1.41 (and advisories note this incomplete fix was addressed). Mitigati...