Описание
GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.
A flaw was found in GitPython. Attackers can bypass the check_unsafe_options guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as clone_from or fetch, leading to arbitrary code execution.
Отчет
This is an Important remote code execution vulnerability in GitPython, affecting Red Hat products that utilize GitPython versions prior to 3.1.54. The flaw allows an attacker to bypass input sanitization by smuggling malicious Git options within single-character keyword arguments, leading to arbitrary command execution when GitPython methods process untrusted input. This poses a significant risk to the integrity and confidentiality of systems.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Affected | ||
| Migration Toolkit for Applications 8 | mta/mta-solution-server-rhel9 | Affected | ||
| Pen Drive Powered by Red Hat Lightspeed | pen-drive/pen-drive-scanner-rhel9 | Affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-cpu-rhel9 | Will not fix | ||
| Red Hat AI Inference Server | rhaiis/vllm-tpu-rhel9 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/controller-rhel8 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/hub-rhel8 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/controller-rhel8 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/hub-rhel8 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/controller-rhel9 | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
8.8 High
CVSS3
Связанные уязвимости
GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.
GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.
GitPython versions before 3.1.54 contain a remote code execution vulne ...
GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.
Уязвимость механизма check_unsafe_options библиотеки Python для взаимодействия с git-репозиториями GitPython, позволяющая нарушителю выполнить произвольный код
8.8 High
CVSS3