Dulwich
Monthly
Arbitrary file write leading to potential code execution affects Dulwich 0.22.5 through 1.2.7 when a victim pops a stash in an attacker-crafted repository, because intermediate directory symlinks are followed and can redirect writes into .git/hooks/post-checkout. Exploitation requires local operation of the affected library plus a multi-step stash workflow and a subsequent checkout, so this is a conditional code-execution risk rather than a drive-by remote compromise; no public exploit code was identified at time of analysis. Dulwich 1.2.8 contains the vendor fix.
Symlink-based path traversal in Dulwich 0.23.1 through 1.2.7 allows an attacker who controls a repository's commit history to write files outside the working directory when a victim runs filter_branch with an index_filter, with code execution possible if the write lands in .git/hooks. Exploitation is conditional: it requires local access and the victim to invoke the history-rewriting operation against the crafted repository, and no public exploit code was identified at time of analysis. Dulwich 1.2.8 fixes the issue by addressing cross-commit symlink persistence.
Path-restricted checkout in Dulwich 0.24.0 through 1.2.7 follows symlinks when writing restored files, so a crafted repository can redirect a selective checkout into arbitrary filesystem locations - including .git/hooks/post-checkout - to plant an executable hook and achieve code execution. Exploitation is conditional: the victim must obtain an attacker-controlled repository whose worktree entry is a symlink (mode 120000) pointing at a sensitive path, then explicitly call porcelain.checkout(paths=[...]) against a tag or ref where that same path is a regular executable blob; a plain clone or default full checkout does not trigger it. No public exploit code has been identified at time of analysis, and the issue is fixed in Dulwich 1.2.8.
Dulwich before 1.2.9 can be driven into an infinite recursion loop by a crafted packfile containing an OFS_DELTA object whose delta_offset is 0, causing CPU exhaustion during clone, fetch, cat-file, or internal object lookups. The flaw is availability-only and requires the victim or service to process an attacker-supplied packfile; publicly available exploit code exists.
Arbitrary file write in Dulwich before 1.2.9 on Windows can be escalated to remote code execution when an unauthenticated remote attacker convinces a victim or an automated Windows CI runner to clone or check out a malicious repository. A crafted Git tree entry whose name is a DOS drive-letter prefix such as 'C:' passes NTFS validation and causes os.path.join to discard the intended worktree root, allowing writes to locations like the user's .gitconfig or Startup folder. A proof-of-concept generator is described in the vendor advisory, so publicly available exploit code exists.
Arbitrary code execution in Dulwich (pure-Python Git implementation) versions 0.23.2 through 1.2.4 allows a malicious upstream repository to drop executable files into a victim's .git/hooks/ directory during a recursive clone or submodule update. When the victim subsequently runs any git or dulwich command that invokes the planted hook, the attacker's code executes with the victim's privileges. No public exploit identified at time of analysis, though the technique mirrors the well-documented upstream Git flaws CVE-2024-32002 and CVE-2024-32004.
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Arbitrary file write leading to potential code execution affects Dulwich 0.22.5 through 1.2.7 when a victim pops a stash in an attacker-crafted repository, because intermediate directory symlinks are followed and can redirect writes into .git/hooks/post-checkout. Exploitation requires local operation of the affected library plus a multi-step stash workflow and a subsequent checkout, so this is a conditional code-execution risk rather than a drive-by remote compromise; no public exploit code was identified at time of analysis. Dulwich 1.2.8 contains the vendor fix.
Symlink-based path traversal in Dulwich 0.23.1 through 1.2.7 allows an attacker who controls a repository's commit history to write files outside the working directory when a victim runs filter_branch with an index_filter, with code execution possible if the write lands in .git/hooks. Exploitation is conditional: it requires local access and the victim to invoke the history-rewriting operation against the crafted repository, and no public exploit code was identified at time of analysis. Dulwich 1.2.8 fixes the issue by addressing cross-commit symlink persistence.
Path-restricted checkout in Dulwich 0.24.0 through 1.2.7 follows symlinks when writing restored files, so a crafted repository can redirect a selective checkout into arbitrary filesystem locations - including .git/hooks/post-checkout - to plant an executable hook and achieve code execution. Exploitation is conditional: the victim must obtain an attacker-controlled repository whose worktree entry is a symlink (mode 120000) pointing at a sensitive path, then explicitly call porcelain.checkout(paths=[...]) against a tag or ref where that same path is a regular executable blob; a plain clone or default full checkout does not trigger it. No public exploit code has been identified at time of analysis, and the issue is fixed in Dulwich 1.2.8.
Dulwich before 1.2.9 can be driven into an infinite recursion loop by a crafted packfile containing an OFS_DELTA object whose delta_offset is 0, causing CPU exhaustion during clone, fetch, cat-file, or internal object lookups. The flaw is availability-only and requires the victim or service to process an attacker-supplied packfile; publicly available exploit code exists.
Arbitrary file write in Dulwich before 1.2.9 on Windows can be escalated to remote code execution when an unauthenticated remote attacker convinces a victim or an automated Windows CI runner to clone or check out a malicious repository. A crafted Git tree entry whose name is a DOS drive-letter prefix such as 'C:' passes NTFS validation and causes os.path.join to discard the intended worktree root, allowing writes to locations like the user's .gitconfig or Startup folder. A proof-of-concept generator is described in the vendor advisory, so publicly available exploit code exists.
Arbitrary code execution in Dulwich (pure-Python Git implementation) versions 0.23.2 through 1.2.4 allows a malicious upstream repository to drop executable files into a victim's .git/hooks/ directory during a recursive clone or submodule update. When the victim subsequently runs any git or dulwich command that invokes the planted hook, the attacker's code executes with the victim's privileges. No public exploit identified at time of analysis, though the technique mirrors the well-documented upstream Git flaws CVE-2024-32002 and CVE-2024-32004.
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.