GitPython Package Vulnerability: Arbitrary File Read Risk
Summary
UBUNTU-CVE-2023-41040: GitPython is a python library used to interact with Git repositories. Affects python-git versions 0.3.2~RC1-2 – 0.3.2~RC1-3ubuntu0.1~esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitPython is a Python library that facilitates interaction with Git repositories, allowing developers to automate and manage Git operations programmatically. It provides a high-level interface for executing Git commands and manipulating repository data. However, due to its design, GitPython is vulnerable to a specific issue that allows unauthorized file access, potentially compromising system security.
Vulnerability Detail
The vulnerability arises from GitPython's handling of file paths when resolving Git references. Specifically, the library reads files from the .git directory based on user-provided input without verifying that the paths remain within this directory. This oversight can allow an attacker to manipulate the input to read arbitrary files from the system, leading to potential information disclosure or denial of service. The vulnerability is documented in the code at a specific location in the GitPython repository, where the base directory is joined with user input without proper validation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict the input provided to GitPython to ensure that it only includes valid references within the .git directory. This can be done by sanitizing user input before passing it to GitPython functions, thereby preventing any attempts to access files outside the intended directory.
Conclusion
The GitPython package has a vulnerability that allows arbitrary file reads due to improper handling of user input. Users are strongly advised to update to version 3.1.37 or later to mitigate this risk. Additionally, implementing input sanitization can provide a temporary workaround until the update is applied.
See every vulnerability recorded for python-git →
FAQ
The CVSS score of this vulnerability is 4.0, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability affects multiple versions of GitPython prior to 3.1.37. Users should upgrade to this version or later.
The vulnerability could allow attackers to read sensitive files from the system or cause denial of service for the application using GitPython.
Yes, users can sanitize input to ensure that only valid paths within the .git directory are processed by GitPython as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for python-git.
