Vulnerability Description
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitpython Project | Gitpython | < 3.1.30 |
| Fedoraproject | Fedora | 36 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8deBroken Link
- https://lists.debian.org/debian-lts-announce/2023/07/msg00024.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202311-01Third Party Advisory
- https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858ExploitThird Party Advisory
- https://github.com/gitpython-developers/GitPython/blob/bec61576ae75803bc4e60d8deBroken Link
- https://lists.debian.org/debian-lts-announce/2023/07/msg00024.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/10/msg00030.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
FAQ
What is CVE-2022-24439?
CVE-2022-24439 is a vulnerability with a CVSS score of 8.1 (HIGH). All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone...
How severe is CVE-2022-24439?
CVE-2022-24439 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-24439?
Check the references section above for vendor advisories and patch information. Affected products include: Gitpython Project Gitpython, Fedoraproject Fedora, Debian Debian Linux.