Описание
GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needed | |
| esm-apps-legacy/xenial | released | 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4 |
| esm-apps/bionic | released | 2.1.8-1ubuntu0.1~esm4 |
| esm-apps/focal | released | 3.0.7-1ubuntu0.1~esm4 |
| esm-apps/jammy | released | 3.1.24-1ubuntu0.1~esm3 |
| esm-apps/noble | released | 3.1.37-3ubuntu0.1~esm2 |
| esm-apps/resolute | released | 3.1.46-1ubuntu0.1~esm1 |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| esm-infra-legacy/trusty | released | 0.3.2~RC1-3ubuntu0.1~esm3 |
| jammy | needed |
Показывать по
EPSS
8.8 High
CVSS3
Связанные уязвимости
GitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.
GitPython is a python library used to interact with Git repositories. ...
GitPython has Command Injection via Git options bypass
Уязвимость функций Repo.clone_from(), Remote.fetch(), Remote.pull() или Remote.push() библиотеки Python для взаимодействия с git-репозиториями GitPython, позволяющая нарушителю выполнить произвольные команды
EPSS
8.8 High
CVSS3