Path Traversal Vulnerability in GitPython: Potential File Access Risk
Summary
CVE-2023-41040: GitPython is a python library used to interact with Git repositories. Affects python-git across 4 version ranges.
< 3.1.14-1+deb11u1
< 74e55ee4544867e1bd976b7df5a45869ee397b0b
< b27a89f683cda85ebd78243c055e876282df89ee
< e98f57b81f792f0f5e18d33ee658ae395f9aa3c4
Fixed in 3.1.14-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitPython is a Python library that facilitates interaction with Git repositories, allowing users to perform Git operations programmatically. It is widely used in various applications for version control and automation tasks. The library's functionality includes reading and writing to Git repositories, managing branches, and handling commits. However, a recent vulnerability has been identified that could allow unauthorized file access, raising concerns about the security of applications utilizing this library.
Vulnerability Detail
The vulnerability, identified as CVE-2023-41040, arises from GitPython's handling of file paths when resolving Git references. Specifically, the library reads files from the .git directory, but it does not adequately validate user-provided file names. This oversight allows an attacker to manipulate the input to read files outside the intended directory. While this vulnerability does not directly expose file contents, it could potentially lead to a denial of service for the application. The affected code can be found in the symbolic.py file, where user input is concatenated with the base directory without proper checks.
How To Fix
Minimum fixed version
3.1.14-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict user input for file names to prevent any potential exploitation. Implementing strict validation checks on file paths before processing them can mitigate the risk. For example, ensure that the input file name does not contain any path traversal characters (like '../') and is limited to expected values.
Conclusion
CVE-2023-41040 poses a significant risk to applications using the GitPython library due to its inadequate validation of user input for file paths. Users are strongly advised to update their installations to mitigate this vulnerability and ensure the security of their applications.
See every vulnerability recorded for python-git →
FAQ
CVE-2023-41040 is a vulnerability in the GitPython library that allows attackers to potentially read files outside the intended .git directory due to insufficient input validation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is the potential for unauthorized file access, which could lead to a denial of service for applications using GitPython.
Yes, users should update to the latest version of GitPython that includes security fixes. For Debian systems, ensure you are using at least version 3.1.30-1+deb12u2.
The CVSS score for CVE-2023-41040 is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-git.
