Описание
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needed | |
| esm-apps-legacy/xenial | released | 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4 |
| esm-apps/bionic | released | 2.1.8-1ubuntu0.1~esm4 |
| esm-apps/focal | released | 3.0.7-1ubuntu0.1~esm4 |
| esm-apps/jammy | released | 3.1.24-1ubuntu0.1~esm3 |
| esm-apps/noble | released | 3.1.37-3ubuntu0.1~esm2 |
| esm-apps/resolute | released | 3.1.46-1ubuntu0.1~esm1 |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| esm-infra-legacy/trusty | released | 0.3.2~RC1-3ubuntu0.1~esm3 |
| jammy | needed |
Показывать по
7.8 High
CVSS3
Связанные уязвимости
GitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \n becomes \n\t), but Git still accepts an indented [core] stanza as a section header — so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout) will then execute scripts from the attacker-controlled path. This issue has been patched in version 3.1.49.
GitPython is a python library used to interact with Git repositories. ...
GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath
7.8 High
CVSS3