PT-2023-4724 · Pypi+6 · Gitpython+6

Beuc · Published 2023-07-25 · Updated 2026-04-26 · CVE-2023-40267

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.32

Description The issue is related to errors in processing input data in the GitPython library, which can allow a remote attacker to execute arbitrary code by injecting a specially crafted URL into the clone command. This is due to improper validation of user input, making it possible to inject a maliciously crafted remote URL into the clone command. The library makes external calls to git without sufficient sanitization of input arguments.

Recommendations For versions prior to 3.1.32, update to version 3.1.32 or later to resolve the issue. As a temporary workaround, consider restricting the use of the clone and clone from functions until a patch is available. Avoid using insecure non-multi options in the clone and clone from commands to minimize the risk of exploitation.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-20

CWE-78

Related Identifiers

ALT-PU-2023-8416

BDU:2023-05150

CVE-2023-40267

DLA-3502-1

DLA-3939-1

GHSA-PR76-5CM5-W9CJ

OESA-2023-1529

OPENSUSE-SU-2024:13146-1

PYSEC-2023-137

RHSA-2023:4971

RHSA-2023:4991

RHSA-2023:5931

RHSA-2023:6818

RLSA-2023:6818

USN-6326-1

Affected Products

Alt Linux

Astra Linux

Gitpython

Linuxmint

Red Os

Rocky Linux

Ubuntu

References · 36

• https://github.com/gitpython-developers/GitPython/pull/1609 · Patch
• https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cdd · Patch
• https://osv.dev/vulnerability/OESA-2023-1529 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-40267 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3502-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pr76-5cm5-w9cj · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2023:6818 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40267 · Security Note
• https://osv.dev/vulnerability/USN-6326-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-40267 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-137 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3939-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF6AXUTC5BO7L2SBJMCVKJSPKWY52I5R · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-40267 · Security Note