REDHAT-BUG-2510032: High severity GitPython GitPython vulnerability
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom(..., multioptions=..., allowunsafeoptions=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.51 - Configuration
When calling Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), ensure you use GitPython version fixed in 3.1.51 to prevent bypass via joined short-option forms like -u<value> (short form of --upload-pack=<value>).
GitPython Repo.clone_from allow_unsafe_options = False
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using GitPython 3.1.50 are exposed if they pass attacker-influenced clone options to Repo.clone_from through multi_options while relying on allow_unsafe_options=False to block unsafe Git options.
What does an attacker need to exploit it?
The attacker needs control over clone-option input supplied to Repo.clone_from(..., multi_options=..., allow_unsafe_options=False). They can provide a joined short option such as -u<helper>, causing Git to execute the specified helper command during the clone.
Are applications using the default unsafe-option setting affected?
Yes, the issue occurs when allow_unsafe_options=False, the default unsafe-option gate, is used. The gate fails to recognize the joined -u<value> form of the blocked upload-pack option.
What version contains the fix?
GitPython 3.1.51 fixes the issue.