CVE-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cdd	Patch
https://github.com/gitpython-developers/GitPython/pull/1609	Issue Tracking Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/
https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cdd	Patch
https://github.com/gitpython-developers/GitPython/pull/1609	Issue Tracking Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/

Configurations

Configuration 1 (hide)

cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*

History

21 Nov 2024, 08:19

Type	Values Removed	Values Added
References	~~() https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cdd - Patch~~	() https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cdd - Patch
References	~~() https://github.com/gitpython-developers/GitPython/pull/1609 - Issue Tracking, Patch~~	() https://github.com/gitpython-developers/GitPython/pull/1609 - Issue Tracking, Patch
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/ -
References	~~() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/ -~~	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/ -
Summary		(es) GitPython antes de 3.1.32 no bloquea opciones inseguras no multi en clone y clone_from. NOTA: este problema existe debido a una corrección incompleta de CVE-2022-24439.

07 Nov 2023, 04:20

Type	Values Removed	Values Added
References	{'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/', 'name': 'FEDORA-2023-1ec4e542f9', 'tags': [], 'refsource': 'FEDORA'} {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/', 'name': 'FEDORA-2023-26116901d9', 'tags': [], 'refsource': 'FEDORA'}	() https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/ -

25 Aug 2023, 03:15

Type	Values Removed	Values Added
References		(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/ -

22 Aug 2023, 19:16

Type	Values Removed	Values Added
References		(FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/ -

18 Aug 2023, 15:29

Type	Values Removed	Values Added
References	~~(MISC) https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cdd -~~	(MISC) https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cdd - Patch
References	~~(MISC) https://github.com/gitpython-developers/GitPython/pull/1609 -~~	(MISC) https://github.com/gitpython-developers/GitPython/pull/1609 - Issue Tracking, Patch
CWE		NVD-CWE-noinfo
First Time		Gitpython Project Gitpython Project gitpython
CPE		cpe:2.3:a:gitpython_project:gitpython::::::python::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8

11 Aug 2023, 07:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-08-11 07:15

Updated : 2024-11-21 08:19

NVD link : CVE-2023-40267

Mitre link : CVE-2023-40267

CVE.ORG link : CVE-2023-40267

JSON object : View

Products Affected

gitpython_project

gitpython

CWE

NVD-CWE-noinfo

9.8 /10