Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2023-40590

Опубликовано: 28 авг. 2023
Источник: redhat
CVSS3: 7.8

Описание

GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the git command, if a user runs GitPython from a repo has a git.exe or git executable, that program will be run instead of the one in the user's PATH. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious git executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like C:\\Program Files\\Git\\cmd\\git.EXE (default git path installation). 2: Require users to set the GIT_PYTHON_GIT_EXECUTABLE environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the GIT_PYTHON_GIT_EXECUTABLE env var to an absolute path. 4: Resolve the executable manually by only looking into the PATH environment variable.

A flaw was found in Python/Windows. When resolving a program, it looks for the current working directory followed by the PATH environment. GitPython defaults to use the git command if a user runs GitPython from a repo, has a git.exe, or git executable, that program will run instead of the one in the user's PATH.

Отчет

This flaw only affects how python finds executables on windows , therefore, does not affect Linux.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Ansible Automation Platform 2automation-controllerNot affected
Red Hat Ansible Automation Platform 2python3x-gitpythonNot affected
Red Hat Ansible Automation Platform 2python-gitdbNot affected
Red Hat Ansible Automation Platform 2python-gitpythonNot affected
Red Hat Ansible Automation Platform 2python-smmapNot affected
Red Hat Certification for Red Hat Enterprise Linux 7redhat-certificationNot affected
Red Hat Certification for Red Hat Enterprise Linux 8redhat-certificationNot affected
Red Hat Certification Program for Red Hat Enterprise Linux 9redhat-certificationNot affected
Red Hat OpenStack Platform 16.1GitPythonNot affected
Red Hat OpenStack Platform 16.1python-gitdbNot affected

Показывать по

Дополнительная информация

Статус:

Important
Дефект:
CWE-426
https://bugzilla.redhat.com/show_bug.cgi?id=2235871gitpython: improper executable lookup on windows

7.8 High

CVSS3

Связанные уязвимости

CVSS3: 7.8
ubuntu
больше 2 лет назад

GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation)...

CVSS3: 7.8
nvd
больше 2 лет назад

GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation).

CVSS3: 7.8
debian
больше 2 лет назад

GitPython is a python library used to interact with Git repositories. ...

CVSS3: 7.8
github
больше 2 лет назад

GitPython untrusted search path on Windows systems leading to arbitrary code execution

CVSS3: 7.8
fstec
больше 2 лет назад

Уязвимость библиотеки Python для взаимодействия с git-репозиториями GitPython, позволяющая нарушителю выполнять произвольные команды

7.8 High

CVSS3