Description
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-git | 3.1.36-1 | — |
| Debian 13 | python-git | 3.1.36-1 | — |
| Debian 12 | python-git | 3.1.30-1+deb12u2 | — |
| Debian 11 | python-git | 3.1.14-1+deb11u1 | DLA-3939-1 |
| Debian 10 | python-git | 2.1.11-1+deb10u1 | DLA-3502-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python-git | 3.1.24-1ubuntu0.1~esm2 | USN-6326-1 |
| Ubuntu Pro 20.04 LTS | python-git | 3.0.7-1ubuntu0.1~esm2 | USN-6326-1 |
| Ubuntu Pro 18.04 LTS | python-git | 2.1.8-1ubuntu0.1~esm2 | USN-6326-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | python-git | 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2 | USN-6326-1 |
| Ubuntu Pro 14.04 LTS | python-git | 0.3.2~RC1-3ubuntu0.1~esm2 | USN-6326-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.5.1.23-1.el8sat | RHSA-2023:6818, RHSA-2023:5931 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.5.1.23-1.el8sat | RHSA-2023:6818, RHSA-2023:5931 |
| Red Hat Satellite Capsule 6 | puppet-agent | 7.26.0-3.el8sat | RHSA-2023:6818, RHSA-2023:5931 |
| Red Hat Satellite Capsule 6 | puppetserver | 7.11.0-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | python-django +1 | 3.2.21-1.el8pc | RHSA-2023:6818, RHSA-2023:5931 |
| Red Hat Satellite Capsule 6 | python-future +1 | 0.18.3-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | python-gitpython +1 | 3.1.32-1.el8pc | RHSA-2023:6818, RHSA-2023:5931 |
| Red Hat Satellite Capsule 6 | python-pulp-ansible +1 | 1:0.16.0-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | python-requests +1 | 2.31.0-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | python-sqlparse +1 | 0.4.4-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite Capsule 6 | rubygem-rack | 2.2.7-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | foreman +12 | 3.5.1.23-1.el8sat | RHSA-2023:6818, RHSA-2023:5931 |
| Red Hat Satellite 6 | foreman-redis | 3.7.0.9-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | puppet-agent | 7.26.0-3.el8sat | RHSA-2023:6818, RHSA-2023:5931 |
| Red Hat Satellite 6 | puppetserver | 7.11.0-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | python-django +1 | 3.2.21-1.el8pc | RHSA-2023:6818, RHSA-2023:5931 |
| Red Hat Satellite 6 | python-future +1 | 0.18.3-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite 6 | python-gitpython +1 | 3.1.32-1.el8pc | RHSA-2023:6818, RHSA-2023:5931 |
| Red Hat Satellite 6 | python-pulp-ansible +1 | 1:0.16.0-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite 6 | python-requests +1 | 2.31.0-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite 6 | python-sqlparse +1 | 0.4.4-1.el8pc | RHSA-2023:6818 |
| Red Hat Satellite 6 | rubygem-actionpack +2 | 6.1.7.3-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | rubygem-git | 1.18.0-1.el8sat | RHSA-2023:6818, RHSA-2023:5931 |
| Red Hat Satellite 6 | rubygem-globalid | 1.1.0-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | rubygem-kubeclient | 4.10.1-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | rubygem-rack | 2.2.7-1.el8sat | RHSA-2023:6818 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.0.3-1.el8sat | RHSA-2023:6818, RHSA-2023:5931 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.3.13-1.el8ap | RHSA-2023:4991, RHSA-2023:4971 |
| Red Hat Ansible Automation Platform 2 | python-gitpython +1 | 3.1.32-1.el9ap | RHSA-2023:4971 |
| Red Hat Ansible Automation Platform 2 | python39-gitpython +1 | 3.1.32-1.el8ap | RHSA-2023:4971 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-GitPython | 3.1.56-1.1 | openSUSE-SU-2026:11419-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | gitpython | < 3.1.32 | 3.1.32 | GHSA-pr76-5cm5-w9cj |
Advisories 9
- RHSA-2023:6818 Red Hat Security Advisory: Satellite 6.14 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:5931 Red Hat Security Advisory: Satellite 6.13.5 Async Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:4971 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2023-2266 Red Hat Ansible Automation Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 2, 2026
- openSUSE-SU-2026:11419-1 python313-GitPython-3.1.56-1.1 on GA media SUSE / openSUSE Security Updates · Aug 2, 2026
- RHSA-2023:4991 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.3 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Jul 31, 2026
- USN-6326-1 python-git vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- DLA-3939-1 python-git - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3502-1 python-git - security update Debian Security (DSA / DLA) · Mar 9, 2026