Security Update for Dulwich Package
Summary
DSA-3206-1: dulwich - security update. Affects dulwich versions < 0.8.5-2+deb7u2. Fixed in 0.8.5-2+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dulwich is a Python implementation of the file formats and protocols used by the Git version control system. It provides functionality for interacting with Git repositories, including reading and writing objects, creating and updating branches, and performing various Git operations. The package is widely used in Python applications that require Git integration.
Vulnerability Detail
The Dulwich package is affected by two vulnerabilities:
-
CVE-2014-9706: This vulnerability allows writing to files under the .git/ directory when checking out working trees. An attacker could exploit this to execute arbitrary code with the privileges of the user running an application based on Dulwich.
-
CVE-2015-0838: This vulnerability is a buffer overflow in the C implementation of the apply_delta() function used when accessing Git objects in pack files. An attacker could leverage this flaw to execute arbitrary code with the privileges of the user running a Git server or client based on Dulwich.
How To Fix
Minimum fixed version
0.8.5-2+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade dulwichTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is crucial to apply the recommended package upgrades to ensure the security of applications using Dulwich.
Conclusion
Dulwich, a Python implementation of Git file formats and protocols, is affected by two vulnerabilities. These vulnerabilities allow arbitrary code execution and can be mitigated by upgrading the Dulwich package to the recommended versions. It is crucial to promptly apply the necessary fixes to ensure the security of applications using Dulwich. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dulwich →
FAQ
Dulwich is a Python implementation of the file formats and protocols used by the Git version control system. It provides functionality for interacting with Git repositories.
CVE-2014-9706 is a vulnerability in Dulwich that allows writing to files under the .git/ directory when checking out working trees. It can lead to the execution of arbitrary code with the user's privileges.
CVE-2015-0838 is a buffer overflow vulnerability in the C implementation of the apply_delta() function used in Dulwich when accessing Git objects in pack files. It can allow the execution of arbitrary code with the user's privileges.
To fix these vulnerabilities, upgrade the Dulwich package to the latest available version. Refer to the provided version numbers for the respective distributions.
No specific workarounds are mentioned. It is recommended to apply the package upgrades as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for dulwich.
