The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3589 advisory.

  - GitPython is a python library used to interact with Git repositories. In order to resolve some git     references, GitPython reads files from the `.git` directory, in some places the name of the file being     read is provided by the user, GitPython doesn't check if this file is located outside the `.git`     directory. This allows an attacker to make GitPython read any file from the system. This vulnerability is     present in https://github.com/gitpython-     developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175. That     code joins the base directory with a user given string without checking if the final path is located     outside the base directory. This vulnerability cannot be used to read the contents of files but could in     theory be used to trigger a denial of service for the program. This issue has not yet been addressed.
    (CVE-2023-41040)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-3589-1 : python-git - LTS security update

medium Nessus Plugin ID 182377

Version 1.0