Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20777-1

Опубликовано: 18 мая 2026
Источник: suse-cvrf

Описание

Security update for python-GitPython

This update for python-GitPython fixes the following issues

  • CVE-2026-42215: command injection via Git options bypass (bsc#1264604).
  • CVE-2026-42284: unsafe option check validates multi_options before shlex.split transforms it (bsc#1264605).
  • CVE-2026-44243: path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository (bsc#1264606).
  • CVE-2026-44244: newline injection in config_writer().set_value() enables RCE via core.hooksPath (bsc#1264608).

Список пакетов

openSUSE Leap 16.0
python313-GitPython-3.1.44-160000.3.1

Ссылки

Описание

GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.

Затронутые продукты
openSUSE Leap 16.0:python313-GitPython-3.1.44-160000.3.1
Ссылки

Описание

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(" ".join(multi_options)). A string like "--branch main --config core.hooksPath=/x" passes validation (starts with --branch), but after split becomes ["--branch", "main", "--config", "core.hooksPath=/x"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.

Затронутые продукты
openSUSE Leap 16.0:python313-GitPython-3.1.44-160000.3.1
Ссылки

Описание

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository's .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.

Затронутые продукты
openSUSE Leap 16.0:python313-GitPython-3.1.44-160000.3.1
Ссылки

Описание

GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header - so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.

Затронутые продукты
openSUSE Leap 16.0:python313-GitPython-3.1.44-160000.3.1
Ссылки