All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-8146a727a8 advisory.

    Latest upstream release with fix for CVE-2022-24439.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3939 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3939-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     October 29, 2024                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-git     Version        : 3.1.14-1+deb11u1     CVE ID         : CVE-2022-24439 CVE-2023-40267 CVE-2023-41040     Debian Bug     : 1027163 1043503

    GitPython provides object model access to a Git repository.

    CVE-2022-24439, CVE-2023-40267 (follow-up)

        Remote Code Execution (RCE) is possible due to improper user input         validation, which makes it possible to inject a maliciously crafted         remote URL into the clone command. Exploiting this vulnerability is         possible because the library makes external calls to git without         sufficient sanitization of input arguments.

    CVE-2023-41040

        GitPython reads files from the `.git` directory, in some places the         name of the file being read is provided by the user, GitPython         doesn't check if this file is located outside the `.git` directory.
        This allows an attacker to make GitPython read any file from the         system.

    For Debian 11 bullseye, these problems have been fixed in version     3.1.14-1+deb11u1.

    We recommend that you upgrade your python-git packages.

    For the detailed security status of python-git please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-git

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS



    Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5931 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security fix(es):

    * Yggdrasil-worker-forwarder (gRPC): Rapid Reset Attack through HTTP/2 enabled web service which leads to     DDoS attack (CVE-2023-44487 & CVE-2023-39325)

    A Red Hat Security Bulletin which addresses further details about this flaw is available in the References     section.

    * Foreman: OS command injection via ct_command and fcct_command (CVE-2022-3874)

    * Foreman: Arbitrary code execution through yaml global parameters (CVE-2023-0462)

    * GitPython: Remote code execution and improper input validation vulnerability (CVE-2022-24439 &     CVE-2023-40267)

    * Ruby-git & tfm-rubygem-git: Code injection vulnerability (CVE-2022-47318 & CVE-2022-46648)

    * Python-django: Multiple flaws (CVE-2023-31047 & CVE-2023-36053)

    * Puppet-agent (openssl): Multiple flaws (CVE-2022-1292 CVE-2022-2068)

    This update fixes the following bugs:

    2238346 - Red Hat supported provisioning templates are not recognized by RH icon on the row for a given     template     2238348 - when creating a backup on rhel7 and restoring on rhel8, the restore process will fail with     permission issues     2238350 - Virtual machine goes in re-provisioning mode while registration host using Global registration     template.
    2238359 - Capsule redundantly synces *-Export-Library repos     2238361 - Can't update the redhat_repository_url without changing the cdn_configuration to custom_cdn     2238363 - katello-certs-check does not cause the installer to halt execution on failure     2238367 - Satellite Web UI >> Hosts >> All Hosts page loading slow even after power isn't selected from     the new option Manage columns.
    2238369 - Content-export incremental with syncable format based does not include productid file into     repodata directory     2238371 - SELinux is preventing pulpcore-worker from read access on the key labeled pulpcore_server_t     2239041 - Reclaim space for repository fails with Cannot delete some instances of model 'Artifact' because     they are referenced through protected foreign keys: 'ContentArtifact.artifact'.
    2238353 - The hammer export command using single thread encryption causes a performance bottleneck.
    2240781 - Remediation from CRC via Satellite shows Failed status even after successful remediation of     Insights recommendations.
    2241914 - NoMethodError: undefined method `fact_values' while trying to perform inventory upload

    Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202311-01 (GitPython: Code Execution via Crafted Input)

  - All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input     validation, which makes it possible to inject a maliciously crafted remote URL into the clone command.
    Exploiting this vulnerability is possible because the library makes external calls to git without     sufficient sanitization of input arguments. (CVE-2022-24439)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-26116901d9 advisory.

    New upstream release fixing CVE-2022-24439.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1ec4e542f9 advisory.

    New upstream release fixing CVE-2022-24439.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3502 advisory.

  - All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input     validation, which makes it possible to inject a maliciously crafted remote URL into the clone command.
    Exploiting this vulnerability is possible because the library makes external calls to git without     sufficient sanitization of input arguments. (CVE-2022-24439)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5968-1 advisory.

    It was discovered that GitPython did not properly sanitize user inputs for remote URLs in the clone     command. By injecting a maliciously crafted remote URL, an attacker could possibly use this issue to     execute arbitrary commands on the host.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-ce7369b9ec advisory.

    Latest upstream release with fix for CVE-2022-24439.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211287	Fedora 37 : GitPython (2022-8146a727a8)	Nessus	Fedora Local Security Checks	critical
209877	Debian dla-3939 : python-git-doc - security update	Nessus	Debian Local Security Checks	critical
194378	RHEL 8 : Satellite 6.13.5 Async Security Update (Important) (RHSA-2023:5931)	Nessus	Red Hat Local Security Checks	critical
184131	GLSA-202311-01 : GitPython: Code Execution via Crafted Input	Nessus	Gentoo Local Security Checks	critical
180184	Fedora 37 : GitPython (2023-26116901d9)	Nessus	Fedora Local Security Checks	critical
180025	Fedora 38 : GitPython (2023-1ec4e542f9)	Nessus	Fedora Local Security Checks	critical
178781	Debian DLA-3502-1 : python-git - LTS security update	Nessus	Debian Local Security Checks	critical
173265	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM / 22.04 ESM : GitPython vulnerability (USN-5968-1)	Nessus	Ubuntu Local Security Checks	critical
169696	Fedora 36 : GitPython (2022-ce7369b9ec)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2022-24439

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical