Critical Vulnerability in Python-Git: Incomplete Fix for CVE-2023-40590
Summary
UBUNTU-CVE-2024-22190: GitPython is a python library used to interact with Git repositories. Affects python-git versions 0.3.2~RC1-2 – 0.3.2~RC1-3ubuntu0.1~esm2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Git is a Python library that facilitates interaction with Git repositories, enabling developers to automate Git commands and manage repositories programmatically. It is widely used in various applications for version control. However, a recent vulnerability has been identified that compromises its security, particularly on Windows systems, where it may execute untrusted binaries.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2023-40590, which affects the way GitPython interacts with Git and Bash executables on Windows. If GitPython uses a shell to run 'git' or 'bash.exe' to interpret hooks, it may inadvertently execute a malicious 'git.exe' or 'bash.exe' from an untrusted repository. This could lead to unauthorized code execution, data breaches, or system compromise, making it critical for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using GitPython features that invoke shell commands on Windows until the package is updated. This includes refraining from executing hooks that rely on 'bash.exe' or similar executables.
Conclusion
The vulnerability in Python-Git poses significant risks, particularly for users on Windows systems. It is crucial to update to the latest patched versions to mitigate these risks and ensure the security of applications that rely on this library.
See every vulnerability recorded for python-git →
FAQ
CVE-2023-40590 is a vulnerability in GitPython that allows for the execution of untrusted binaries on Windows systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized code execution, data breaches, and potential system compromise, especially on Windows platforms.
You can update the package using your package manager. For example, on Ubuntu, you can run 'sudo apt-get update' followed by 'sudo apt-get install python-git' to get the latest version.
The CVSS score of this vulnerability is 7.8, indicating a high level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for python-git.
