Critical Command Execution Vulnerability in python-git Package
Summary
USN-6326-1: python-git vulnerability. Affects python-git versions < 0.3.2~RC1-3ubuntu0.1~esm2. Fixed in 0.3.2~RC1-3ubuntu0.1~esm2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-git package is a Python library that provides an interface to Git repositories, allowing users to interact with Git repositories programmatically. It is widely used in applications that require version control functionalities. This package is essential for developers who need to automate Git operations within their Python applications. However, a recent vulnerability has been identified that could allow attackers to exploit insecure options in user inputs.
Vulnerability Detail
It was discovered that GitPython, the underlying library used by python-git, did not properly block insecure options from user inputs in the clone command. This oversight could allow an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access or data manipulation. The vulnerability is identified as CVE-2023-40267, which poses a significant risk to systems utilizing affected versions of the python-git package.
How To Fix
Minimum fixed version
0.3.2~RC1-3ubuntu0.1~esm2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-gitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the clone command with untrusted inputs until the package is updated. Implementing strict input validation and sanitization can help mitigate the risk of exploitation.
Conclusion
The python-git package has a critical vulnerability that could allow attackers to execute arbitrary commands on affected systems. It is crucial for users to update to the latest patched version to protect their applications. Additionally, employing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for python-git →
FAQ
The vulnerability allows attackers to execute arbitrary commands on the host due to insecure options not being blocked in user inputs.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The vulnerability affects multiple versions of python-git across different Ubuntu LTS releases, including versions prior to the patched releases.
Yes, updating to the latest patched version of python-git will resolve the vulnerability.
If immediate updates are not possible, ensure to validate and sanitize all user inputs to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-git.
