Skip to content
OpenAdvisories
High USN-5968-1 1 CVE

python-git vulnerability

Published Mar 22, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that GitPython did not properly sanitize user inputs for
remote URLs in the clone command. By injecting a maliciously crafted
remote URL, an attacker could possibly use this issue to execute arbitrary
commands on the host.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS python-git 0.3.2~RC1-3ubuntu0.1~esm1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS python-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS python-git 2.1.8-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-git 3.0.7-1ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS python-git 3.1.24-1ubuntu0.1~esm1

Vulnerabilities 1

  • High 8.1
    CVE-2022-24439 Public exploit

    Remote Code Execution (RCE)

    All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because…

    gitpython python-git python-git Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2022-24439