Skip to content
OpenAdvisories
High WID-SEC-2026-4532 4 CVEs

Red Hat Ansible Automation Platform (GitPython): Mehrere Schwachstellen

Published Nov 11, 2026 · Updated Nov 11, 2026 · de

Vendor: Red Hat Product: Ansible Automation Platform

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen, sensible Inhalte lokaler Dateien offenzulegen und einen Denial-of-Service-Zustand auszulösen.

Product

Red Hat Ansible Automation Platform ist eine End-to-End-Automatisierungsplattform für die Systemkonfiguration, die Softwarebereitstellung und die Orchestrierung erweiterter Workflows.

Vulnerabilities 4

  • High 8.1
    CVE-2026-110858

    GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec

    GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to e…

    gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  • High 7.5
    CVE-2026-110856

    GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date

    GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing lon…

    gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  • High 7.5
    CVE-2026-110857

    GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs

    GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when g…

    gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI
  • High 7.5
    CVE-2026-110859

    GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name

    GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --path…

    gitpython-developers GitPython gitpython python-git Debian Ubuntu PyPI

Revision history

  1. #1

    Initiale Fassung

References