Описание
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.
EPSS
6.5 Medium
CVSS3
Дефекты
Связанные уязвимости
(GitPython versions before 3.1.58 fail to validate options passed to gi ...)
GitPython versions before 3.1.58 fail to validate options passed to gi ...
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.
EPSS
6.5 Medium
CVSS3