Gitpython
CVE-2023-40267
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1Blast Radius
ecosystem impact- 42 pypi packages depend on gitpython (38 direct, 5 indirect)
Ecosystem-wide dependent count for version 3.1.32.
DescriptionNVD
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
AnalysisAI
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Technical ContextAI
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439. Affected products include: Gitpython Project Gitpython. Version information: before 3.1.32.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
Command injection in GitPython 3.1.30-3.1.46 allows remote authenticated attackers to execute arbitrary commands via und
Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using
Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution vi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today