critique
CVE-2022-24439
GitPython: improper user input validation leads into a RCE
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA. Plus basse selon Red Hat (moyenne), Ubuntu (moyenne).
Description
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | gitpython | 3.1.30 |
| debian 10 | python-git | 2.1.11-1+deb10u1 |
| debian 11 | python-git | 3.1.14-1+deb11u1 |
| debian 12 | python-git | 3.1.30-1 |
| debian 13 | python-git | 3.1.30-1 |
| debian 14 | python-git | 3.1.30-1 |
| echo | python-git | 3.1.30-1 |
| Red Hat | GitPython, python-gitpython, python3-GitPython | pas de correctif indiqué |
| ubuntu 14.04-ESM | python-git | 0.3.2~RC1-3ubuntu0.1~esm1 |
| ubuntu 16.04-ESM | python-git | 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | python-git | 2.1.8-1ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | python-git | 3.0.7-1ubuntu0.1~esm1 |
Afficher les 16 entrées de 14 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | gitpython | 3.1.30 |
| debian 10 | python-git | 2.1.11-1+deb10u1 |
| debian 11 | python-git | 3.1.14-1+deb11u1 |
| debian 12 | python-git | 3.1.30-1 |
| debian 13 | python-git | 3.1.30-1 |
| debian 14 | python-git | 3.1.30-1 |
| echo | python-git | 3.1.30-1 |
| Red Hat | GitPython | pas de correctif indiqué |
| Red Hat | python-gitpython | pas de correctif indiqué |
| Red Hat | python3-GitPython | pas de correctif indiqué |
| ubuntu 14.04-ESM | python-git | 0.3.2~RC1-3ubuntu0.1~esm1 |
| ubuntu 16.04-ESM | python-git | 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | python-git | 2.1.8-1ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | python-git | 3.0.7-1ubuntu0.1~esm1 |
| ubuntu 22.04 | python-git | pas de correctif indiqué |
| ubuntu 22.10 | python-git | 3.1.27-1ubuntu0.1 |
Références
- https://access.redhat.com/security/cve/CVE-2022-24439
- https://github.com/gitpython-developers/GitPython
- https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py#L1249
- https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8de7a629c194313d1c/git/repo/base.py%23L1249
- https://github.com/gitpython-developers/GitPython/commit/2625ed9fc074091c531c27ffcba7902771130261
- https://github.com/gitpython-developers/GitPython/issues/1515
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.30
- https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2022-42992.yaml
Les 23 références
- https://lists.debian.org/debian-lts-announce/2023/07/msg00024.html
- https://lists.debian.org/debian-lts-announce/2024/10/msg00030.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJHN3QUXPJIMM6SULIR3PR34UFWRAE7X/
- https://nvd.nist.gov/vuln/detail/CVE-2022-24439
- https://security.gentoo.org/glsa/202311-01
- https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858
- https://ubuntu.com/security/notices/USN-5968-1
- https://www.cve.org/CVERecord?id=CVE-2022-24439