Critical Vulnerability in Python-Git: Insecure Clone Options
Summary
UBUNTU-CVE-2023-40267: GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Affects python-git versions < 0.3.2~RC1-3ubuntu0.1~esm2. Fixed in 0.3.2~RC1-3ubuntu0.1~esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Git is a Python library used for interacting with Git repositories. It provides an interface to execute Git commands and manage repositories programmatically. This library is widely utilized in various applications for version control and source code management. However, a recent vulnerability has been identified that compromises its security, allowing potential exploitation through insecure cloning options.
Vulnerability Detail
GitPython before version 3.1.32 does not block insecure non-multi options in clone and clone_from methods. This vulnerability arises from an incomplete fix for CVE-2022-24439, which could allow attackers to manipulate the cloning process, leading to unauthorized access to sensitive data or execution of malicious code. The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
How To Fix
Minimum fixed version
0.3.2~RC1-3ubuntu0.1~esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the clone and clone_from methods with insecure options until the package is updated. Review the code to ensure that only secure options are utilized during cloning operations.
Conclusion
The vulnerability in Python-Git poses a significant risk due to its potential for exploitation through insecure cloning options. Users are strongly advised to update to the latest patched version to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python-git →
FAQ
The vulnerability allows insecure cloning options that could be exploited to access sensitive data or execute malicious code.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
If immediate updates are not possible, avoid using insecure cloning options and review your code for security best practices.
Vulert monitors and alerts for open-source vulnerabilities using a manifest file like package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for python-git.
