Skip to content
OpenAdvisories
Critical USN-6326-1 1 CVE

python-git vulnerability

Published Aug 31, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that GitPython did not block insecure options from user
inputs in the clone command. An attacker could possibly use this issue to
execute arbitrary commands on the host.

Fixed packages 5

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS python-git 0.3.2~RC1-3ubuntu0.1~esm2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS python-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS python-git 2.1.8-1ubuntu0.1~esm2
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS python-git 3.0.7-1ubuntu0.1~esm2
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS python-git 3.1.24-1ubuntu0.1~esm2

Vulnerabilities 1

  • Critical 9.8
    CVE-2023-40267

    GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments

    GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

    gitpython python-git python-git Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2023-40267