PYSEC-2023-137

vendorUSosv

view advisory published 2023-08-11Licence: CC-BY-4.0

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-40267US	critical9.8	1.18% (68th)	—	2023-08-11
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

references

External citations — patches, advisories, analysis.

https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cddFIX
https://github.com/gitpython-developers/GitPython/pull/1609WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan