ALT-PU-2026-8101: package python3-module-GitPython update to version 3.1.50-alt0.p10.1
Описание
This update upgrades python3-module-GitPython to version 3.1.50-alt0.p10.1.
Устраненные уязвимости11
Ссылки5
GHSA-7545-fcxq-7j24
https://github.com/advisories/GHSA-7545-fcxq-7j24GHSA-rpm5-65cw-6hj4
https://github.com/advisories/GHSA-rpm5-65cw-6hj4GHSA-v87r-6q3f-2j67
https://github.com/advisories/GHSA-v87r-6q3f-2j67GHSA-x2qx-6953-8485
https://github.com/advisories/GHSA-x2qx-6953-8485Связанные уязвимости
ALT-PU-2026-7519: package `python3-module-GitPython` update to version 3.1.50-alt1
GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.
GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.