CVE-2022-24439
High
Description
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Gitpython
PublishedDec 6, 2022
First seenDec 6, 2022
How to fix
Update
- gitpython_project gitpython3.1.30 or later
- gitpython3.1.30 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/
- security.gentoo.org/glsa/202311-01
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitpython_project gitpython | v < 3.1.30 | 3.1.30 |
| fedoraproject fedora | 36, 37, 38 | — |
| debian debian_linux | 10.0 | — |
| gitpythonPyPI | v < 3.1.30 | 3.1.30 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.