All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
22 Aug 2023, 19:16
Type | Values Removed | Values Added |
---|---|---|
References |
|
25 Jul 2023, 12:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-12-06 05:15
Updated : 2024-02-04 23:14
NVD link : CVE-2022-24439
Mitre link : CVE-2022-24439
CVE.ORG link : CVE-2022-24439
JSON object : View
Products Affected
gitpython_project
- gitpython
fedoraproject
- fedora
debian
- debian_linux
CWE
CWE-20
Improper Input Validation