REDHAT-BUG-2515261: High severity GitPython GitPython vulnerability
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.57
Event History
Frequently Asked Questions
What attacker access is required to exploit this issue?
An attacker must be able to influence keyword arguments passed to GitPython's IndexFile.checkout() or TagReference.create() methods. The issue arises when those kwargs are forwarded as Git command-line options without adequate validation.
What impact can unsafe options have?
The --prefix option can be used to overwrite arbitrary files with repository content. The -F option can read arbitrary files and return their contents in-band.
Which deployments should be prioritized for review?
Prioritize applications using GitPython versions before 3.1.57 where untrusted users, requests, plugins, or automation inputs can affect kwargs supplied to IndexFile.checkout() or TagReference.create().
How can exposure be reduced if an update cannot be applied immediately?
Prevent untrusted input from reaching kwargs for IndexFile.checkout() and TagReference.create(), and allow only explicitly validated option names and values. Avoid forwarding user-controlled Git options, particularly --prefix and -F.