Описание
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message.
A flaw was found in GitPython. A remote attacker with low privileges can exploit a vulnerability in the TagReference.create() function, where a positional reference parameter bypasses a security guard. This allows the attacker to supply a specially crafted reference value, such as --file=<path>, to read arbitrary files on the system. The contents of these files are then returned within the annotated tag message, leading to information disclosure.
Отчет
A flaw was found in GitPython's TagReference.create() function. An incomplete fix for a prior vulnerability (GHSA-3f7w-8rr8-f37f) failed to validate positional parameters, allowing an attacker with low privileges to supply a specially crafted reference value (such as --file=/path/to/file) to read arbitrary files on the system. The file contents are then returned within the annotated tag message, leading to information disclosure. This vulnerability requires that the application forwards user-controlled input to the reference parameter of TagReference.create(), which limits the scope of exploitation to applications that expose this specific code path.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. For additional information, refer to the upstream advisory at https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Affected | ||
| Exploit Intelligence | exploit-intelligence/vulnerability-analysis-rhel9 | Affected | ||
| Migration Toolkit for Applications 8 | mta/mta-solution-server-rhel9 | Affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-cpu-rhel9 | Affected | ||
| Red Hat AI Inference Server | rhaiis/vllm-tpu-rhel9 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/controller-rhel8 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/hub-rhel8 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/controller-rhel8 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/hub-rhel8 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/controller-rhel9 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with contents returned in the annotated tag message.
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with contents returned in the annotated tag message.
GitPython before 3.1.59 contains an arbitrary file read vulnerability ...
GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)
EPSS
6.5 Medium
CVSS3