Critical Remote Code Execution Vulnerability in Python-Git Package
Summary
UBUNTU-CVE-2022-24439: All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Affects python-git versions < 0.3.2~RC1-3ubuntu0.1~esm1. Fixed in 0.3.2~RC1-3ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Python-Git package is a Python library used for interacting with Git repositories. It provides a simple interface for executing Git commands and managing repositories programmatically. This package is widely utilized in various applications that require version control functionalities. However, it has been identified that all versions of this package are vulnerable to a critical Remote Code Execution (RCE) vulnerability due to improper user input validation.
Vulnerability Detail
The vulnerability arises from the package's failure to adequately validate user input when constructing commands to clone repositories. This oversight allows an attacker to inject a maliciously crafted remote URL into the clone command, potentially leading to arbitrary code execution on the host system. The implications of this vulnerability are severe, as it can allow attackers to execute arbitrary commands, steal sensitive information, or compromise the integrity of the system.
How To Fix
Minimum fixed version
0.3.2~RC1-3ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the vulnerable functionalities of the Python-Git package until the package is updated. It is advisable to validate any user input that is passed to Git commands manually to prevent potential exploitation.
Conclusion
The Python-Git package has a critical vulnerability that allows for Remote Code Execution due to improper input validation. Users are strongly advised to update to the patched versions provided for their respective Ubuntu distributions to mitigate the risk. Temporary workarounds include avoiding vulnerable functionalities and implementing input validation.
See every vulnerability recorded for python-git →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check your application at Vulert Scanner without any signup.
Exploitation of this vulnerability can lead to Remote Code Execution, allowing attackers to execute arbitrary commands on the host system, potentially compromising sensitive data and system integrity.
Yes, patched versions of the Python-Git package are available for various Ubuntu distributions. Users should update to the latest version as specified in the 'how to fix' section.
If immediate updates are not possible, consider implementing input validation for any user inputs that are passed to Git commands to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for python-git.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
