Описание
Security update for python-GitPython
This update for python-GitPython fixes the following issues:
- CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the git directory using tracked files and execute arbitrary code by placing pre-commit hooks in the tracked hooks directory (bsc#1279905).
- CVE-2026-87818: failure to restrict the
--no-indexoption in the high-level diff API allows attackers to read arbitrary filesystem paths as repository operands and create content-dependent Boolean oracles (bsc#1279906). - CVE-2026-87819: quadratic backtracking in the
Actor.name_email_regexregular expression allows attackers to cause CPU exhaustion and a DoS via a commit with a malformed author field (bsc#1279907).
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Module for Python 3 15 SP7
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:4191-1
- E-Mail link for SUSE-SU-2026:4191-1
- SUSE Security Ratings
- SUSE Bug 1279905
- SUSE Bug 1279906
- SUSE Bug 1279907
- SUSE CVE CVE-2026-87817 page
- SUSE CVE CVE-2026-87818 page
- SUSE CVE CVE-2026-87819 page
Описание
GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.
Затронутые продукты
Ссылки
- CVE-2026-87817
- SUSE Bug 1279905
Описание
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.
Затронутые продукты
Ссылки
- CVE-2026-87818
- SUSE Bug 1279906
Описание
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.
Затронутые продукты
Ссылки
- CVE-2026-87819
- SUSE Bug 1279907