p PatchFirst

CVE-2022-24439

CVE-2022-24439 · Remote Code Execution (RCE)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

CVSS 8.1 · High · EPSS 6.1% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • gitpython

    Versions
    • ≥ 0, < unspecified: Affected (custom)

    No fix published

  • python-git Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.1.30-1

    Update to 3.1.30-1

  • python-git Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.1.30-1

    Update to 3.1.30-1

  • python-git Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.1.30-1

    Update to 3.1.30-1

  • gitpython PyPI

    Versions
    • 0.1.7
    • 0.2.0-beta1
    • 0.3.0-beta1
    • 0.3.0-beta2
    • 0.3.1-beta2
    • 0.3.2
    • 0.3.2.1
    • 0.3.2.RC1
    • 0.3.3
    • 0.3.4
    • 0.3.5
    • 0.3.6
    • 0.3.7
    • 1.0.0
    • 1.0.1
    • 1.0.2
    • 2.0.0
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.0.8
    • 2.0.9
    • 2.0.9.dev0
    • 2.0.9.dev1
    • 2.1.0
    • 2.1.1
    • 2.1.10
    • 2.1.11
    • 2.1.12
    • 2.1.13
    • 2.1.14
    • 2.1.15
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.1.7
    • 2.1.8
    • 2.1.9
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.5
    • 3.0.6
    • 3.0.7
    • 3.0.8
    • 3.0.9
    • 3.1.0
    • 3.1.1
    • 3.1.10
    • 3.1.11
    • 3.1.12
    • 3.1.13
    • 3.1.14
    • 3.1.15
    • 3.1.16
    • 3.1.17
    • 3.1.18
    • 3.1.19
    • 3.1.2
    • 3.1.20
    • 3.1.22
    • 3.1.23
    • 3.1.24
    • 3.1.25
    • 3.1.26
    • 3.1.27
    • 3.1.28
    • 3.1.29
    • 3.1.3
    • 3.1.4
    • 3.1.5
    • 3.1.6
    • 3.1.7
    • 3.1.8
    • 3.1.9
    Affected ranges
    • ECOSYSTEM: < 3.1.30

    Update to 3.1.30

  • python-git Ubuntu:Pro:14.04:LTS

    Versions
    • 0.3.2~RC1-2
    • 0.3.2~RC1-3
    Affected ranges
    • ECOSYSTEM: < 0.3.2~RC1-3ubuntu0.1~esm1

    Update to 0.3.2~RC1-3ubuntu0.1~esm1

  • python-git Ubuntu:Pro:16.04:LTS

    Versions
    • 1.0.1+git137-gc8b8379-1
    • 1.0.1+git137-gc8b8379-2
    • 1.0.1+git137-gc8b8379-2.1
    Affected ranges
    • ECOSYSTEM: < 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1

    Update to 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1

  • python-git Ubuntu:Pro:18.04:LTS

    Versions
    • 2.1.5-1
    • 2.1.6-1
    • 2.1.7-1
    • 2.1.8-1
    Affected ranges
    • ECOSYSTEM: < 2.1.8-1ubuntu0.1~esm1

    Update to 2.1.8-1ubuntu0.1~esm1

  • python-git Ubuntu:Pro:20.04:LTS

    Versions
    • 2.1.11-1
    • 3.0.4-1
    • 3.0.5-1
    • 3.0.7-1
    Affected ranges
    • ECOSYSTEM: < 3.0.7-1ubuntu0.1~esm1

    Update to 3.0.7-1ubuntu0.1~esm1

  • python-git Ubuntu:Pro:22.04:LTS

    Versions
    • 3.1.14-1
    • 3.1.23-1
    • 3.1.24-1
    Affected ranges
    • ECOSYSTEM: < 3.1.24-1ubuntu0.1~esm1

    Update to 3.1.24-1ubuntu0.1~esm1

Original sources

Check your server →