GitPython is a python library used to interact with Git repositories. In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is present in https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That code joins the base directory with a user given string without checking if the final path is located outside the base directory. This vulnerability cannot be used to read the contents of files but could in theory be used to trigger a denial of service for the program. This issue has been addressed in version 3.1.37.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3939 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3939-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     October 29, 2024                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-git     Version        : 3.1.14-1+deb11u1     CVE ID         : CVE-2022-24439 CVE-2023-40267 CVE-2023-41040     Debian Bug     : 1027163 1043503

    GitPython provides object model access to a Git repository.

    CVE-2022-24439, CVE-2023-40267 (follow-up)

        Remote Code Execution (RCE) is possible due to improper user input         validation, which makes it possible to inject a maliciously crafted         remote URL into the clone command. Exploiting this vulnerability is         possible because the library makes external calls to git without         sufficient sanitization of input arguments.

    CVE-2023-41040

        GitPython reads files from the `.git` directory, in some places the         name of the file being read is provided by the user, GitPython         doesn't check if this file is located outside the `.git` directory.
        This allows an attacker to make GitPython read any file from the         system.

    For Debian 11 bullseye, these problems have been fixed in version     3.1.14-1+deb11u1.

    We recommend that you upgrade your python-git packages.

    For the detailed security status of python-git please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-git

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS



    Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-7b78427a7d advisory.

    Automatic update for GitPython-3.1.40-1.fc40.

    ##### **Changelog**

    ```
    * Thu Nov  9 2023 Carl George <carlwgeorge@fedoraproject.org> - 3.1.40-1
    - Update to version 3.1.40, resolves rhbz#2221770
    - Fix CVE-2023-41040, resolves rhbz#2248698

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0322 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * python3-gitpython/python39-gitpython: Blind local file inclusion (CVE-2023-41040)

    * python3-twisted/python39-twisted: disordered HTTP pipeline response in twisted.web (CVE-2023-46137)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional changes:
    * python3-dynaconf/python39-dynaconf has been updated to 3.1.12-2
    * python3-gitpython/python39-gitpython has been updated to 3.1.40
    * python3-twisted/python39-twisted has been updated to 23.10.0

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0190 advisory.

    GitPython is a python library used to interact with Git repositories.

    Security Fix(es):

    * Blind local file inclusion (CVE-2023-41040)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7851 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security fix(es):

    * rubygem-actionpack: actionpack: Possible XSS via User Supplied Values to redirect_to     [rhn_satellite_6.14] (CVE-2023-28362)

    * foreman: World readable file containing secrets [rhn_satellite_6.14] (CVE-2023-4886)

    * python-urllib3: urllib3: Request body not stripped after redirect from 303 status changes request method     to GET [rhn_satellite_6-default] (CVE-2023-45803 )

    *  python-gitpython: GitPython: Blind local file inclusion [rhn_satellite_6-default] (CVE-2023-41040)

    This update fixes the following bugs:

    2250342 - REX job finished with exit code 0 but the script failed on client side due to no space.
    2250343 - Selinux denials are reported after following Chapter 13. Managing Custom File Type Content     chapter step by step     2250344 - Long running postgres threads during content-export     2250345 - Upgrade django-import-export package to at least 3.1.0     2250349 - After upstream repo switched to zst compression, Satellite 6.12.5.1 unable to sync     2250350 - Slow generate applicability for Hosts with multiple modulestreams installed     2250352 - Recalculate button for Errata is not available on Satellite 6.13/ Satellite 6.14 if no errata is     present     2250351 - Actions::ForemanLeapp::PreupgradeJob fails with null value in column preupgrade_report_id     violates not-null constraint when run with non-admin user     2251799 - REX Template for 'convert2rhel analyze' command     2254085 - Getting '/usr/sbin/foreman-rake db:migrate' returned 1 instead of one of [0] ERROR while trying     to upgrade Satellite 6.13 to 6.14     2254080 - satellite-convert2rhel-toolkit rpm v1.0.0 in 6.14.z

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1640 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Django: denial-of-service in 'intcomma' template filter (CVE-2024-24680)
    * automation-controller: aiohttp: http request smuggling (CVE-2024-23829)
    * automation-controller: aiohttp: follow_symlinks directory traversal vulnerability (CVE-2024-23334)
    * automation-controller: Jinja2: HTML attribute injection when passing user input as keys to xmlattr     filter (CVE-2024-22195)
    * automation-controller: cryptography: NULL-dereference when loading PKCS7 certificates (CVE-2023-49083)
    * automation-controller: aiohttp: numerous issues in HTTP parser with header parsing (CVE-2023-47627)
    * automation-controller: Twisted: disordered HTTP pipeline response in twisted.web (CVE-2023-46137)
    * automation-controller: axios: exposure of confidential data stored in cookies (CVE-2023-45857)
    * automation-controller: GitPython: Blind local file inclusion (CVE-2023-41040)
    * python3-aiohttp/python39-aiohttp: http request smuggling (CVE-2024-23829)
    * python3-aiohttp/python39-aiohttp: follow_symlinks directory traversal vulnerability (CVE-2024-23334)
    * python3-django/python39-django: Potential regular expression denial-of-service in     django.utils.text.Truncator.words() (CVE-2024-27351)
    * receptor: golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads     (CVE-2024-1394)
    * receptor: golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests     (CVE-2023-39326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes for automation controller:
    * Fixed bug where schedule prompted variables and survey answers were reset on edit when changing one of     the basic form fields (AAP-20967)
    * Fixed the update execution environment image to no longer fail jobs that use the previous image     (AAP-21733)
    * Removed string validation using comparisons of English literals for comparison, replacing validation     with error/op codes as a universal approach to validation and comparison (AAP-21721)
    * Fixed dispatcher to appropriately terminate child processes when dispatcher terminates (AAP-21049)
    * Fixed upgrade from Ansible Tower 3.8.6 to AAP 2.4 to no longer fail upon database schema migration     (AAP-19738)
    * automation-controller has been updated to 4.5.5

    Updates and fixes for receptor:
    * Fixes a receptor dialing issue where the connection attempt is timed out too aggressively (AAP-21838,     AAP-21828)
    * receptor has been updated to 1.4.5

    Additional fixes:
    * ansible-core has been updated to 2.15.10
    * ansible-runner has been updated to 2.3.6
    * python3-aiohttp/python39-aiohttp has been updated to 3.9.3
    * python3-django/python39-django has been updated  4.2.11
    * python3-pulpcore/python39-pulpcore has been updated 3.28.24

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:0215 advisory.

    GitPython is a python library used to interact with Git repositories.

    Security Fix(es):

    * Blind local file inclusion (CVE-2023-41040)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3589 advisory.

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has not yet been addressed.
    (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0271-1 advisory.

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has not yet been addressed.
    (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2023:0259-1 advisory.

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has not yet been addressed.
    (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
209877	Debian dla-3939 : python-git-doc - security update	Nessus	Debian Local Security Checks	critical
194559	Fedora 40 : GitPython (2023-7b78427a7d)	Nessus	Fedora Local Security Checks	medium
194438	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:0322)	Nessus	Red Hat Local Security Checks	medium
194409	RHEL 8 : Red Hat OpenStack Platform 17.1 (GitPython) (RHSA-2024:0190)	Nessus	Red Hat Local Security Checks	medium
194386	RHEL 8 : Satellite 6.14.1 Async Security Update (Moderate) (RHSA-2023:7851)	Nessus	Red Hat Local Security Checks	critical
193086	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:1640)	Nessus	Red Hat Local Security Checks	critical
189084	RHEL 9 : Red Hat OpenStack Platform 17.1 (GitPython) (RHSA-2024:0215)	Nessus	Red Hat Local Security Checks	medium
182377	Debian DLA-3589-1 : python-git - LTS security update	Nessus	Debian Local Security Checks	medium
181920	openSUSE 15 Security Update : python-GitPython (openSUSE-SU-2023:0271-1)	Nessus	SuSE Local Security Checks	medium
181859	openSUSE 15 Security Update : python-GitPython (openSUSE-SU-2023:0259-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-41040

medium

Tenable Plugins

critical

medium

medium

medium

critical

critical

medium

medium

medium

medium