PT-2022-7372 · Gitpython+5 · Gitpython+5

Sam Wheating · Published 2022-12-06 · Updated 2025-03-06 · CVE-2022-24439

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions gitpython versions (affected versions not specified)

Description The issue is related to improper user input validation in the gitpython library, which allows for Remote Code Execution (RCE) due to insufficient sanitization of input arguments when making external calls to git. This enables an attacker to inject a maliciously crafted remote URL into the clone command. The vulnerability is exploited because of the library's failure to properly clean input arguments before passing them to git.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-20

Related Identifiers

ALT-PU-2023-8415

BDU:2024-04480

CVE-2022-24439

DLA-3502-1

DLA-3939-1

GHSA-HCPJ-QP55-GFPH

MGASA-2023-0001

OESA-2023-1529

OPENSUSE-SU-2024:12596-1

OPENSUSE-SU-2024:13510-1

OPENSUSE-SU-2025:14858-1

PYSEC-2022-42992

RHSA-2023:5931

USN-5968-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Os

Ubuntu

Gitpython

References · 61

• 🔥 https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858 · Exploit
• https://osv.dev/vulnerability/OESA-2023-1529 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24439 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14858-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24439 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24439 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3502-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202311-01 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3939-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcpj-qp55-gfph · Vendor Advisory
• https://osv.dev/vulnerability/USN-5968-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV5DV7GBLMOZT7U3Q4TDOJO5R6G3V6GH · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R · Vendor Advisory