Описание
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output= can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.
A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive() and git.ls_remote(), potentially leading to arbitrary code execution. Additionally, functions such as Repo.iter_commits() and Repo.blame() do not validate revision arguments, which could allow an attacker to truncate arbitrary files. Exploitation requires an application to pass attacker-controlled input directly to these vulnerable methods.
Отчет
This is an Important vulnerability because it allows for arbitrary code execution or file truncation. The flaw in GitPython requires an application to process attacker-controlled input through specific GitPython methods, such as Repo.archive() or git.ls_remote(), to be exploited. This could lead to a compromise of confidentiality, integrity, and availability on affected Red Hat products that utilize GitPython in such a manner.
Меры по смягчению последствий
To mitigate the risk, ensure that applications utilizing GitPython are run within a sandboxed environment with minimal privileges. This limits the potential impact of arbitrary command execution or file truncation if an attacker successfully exploits the vulnerability through an application processing untrusted input. Review applications that interact with GitPython to ensure all input is properly sanitized and validated before being passed to methods such as Repo.archive(), git.ls_remote(), Repo.iter_commits(), or Repo.blame().
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Affected | ||
| Migration Toolkit for Applications 8 | mta/mta-solution-server-rhel9 | Affected | ||
| Pen Drive Powered by Red Hat Lightspeed | pen-drive/pen-drive-scanner-rhel9 | Affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-cpu-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaiis/vllm-tpu-rhel9 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/controller-rhel8 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/hub-rhel8 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/controller-rhel8 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/hub-rhel8 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/controller-rhel9 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.4 High
CVSS3
Связанные уязвимости
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.
GitPython before 3.1.51 fails to guard against dangerous Git options p ...
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.
Уязвимость функций Repo.archive(), git.ls_remote(), Repo.iter_commits() и Repo.blame() библиотеки Python для взаимодействия с git-репозиториями GitPython, позволяющая нарушителю выполнить произвольные команды и перезаписать произвольные файлы
EPSS
8.4 High
CVSS3