MGASA-2026-0372

Dashboard / Vulnerabilities / MGASA-2026-0372

MGASA-2026-0372

Summary: Updated python-gitpython packages fix security vulnerabilities

Details: CVE-2023-40267 GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439. CVE-2023-41040 In order to resolve some git references, GitPython reads files from the `.git` directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the `.git` directory. This allows an attacker to make GitPython read any file from the system. CVE-2026-42215 From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at its default value of False. This issue has been patched in version 3.1.47.

References: https://advisories.mageia.org/MGASA-2026-0372.html, https://bugs.mageia.org/show_bug.cgi?id=35535, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH/, https://lists.debian.org/debian-lts-announce/2023/09/msg00036.html, https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.50, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.46, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.45, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.44, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.43, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.42, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.41, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.40, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.38, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.37, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.35, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.34, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.33, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.32, https://github.com/gitpython-developers/GitPython/releases/tag/3.1.31