USN-6326-1: GitPython vulnerability
Published Aug 31, 2023
·Updated
It was discovered that GitPython did not block insecure options from user inputs in the clone command. An attacker could possibly use this issue to execute arbitrary commands on the host.
Affected Software
16 affected componentsFixes available
All of the following
ubuntu/python3-git<3.1.30-1ubuntu0.23.04.1
3.1.30-1ubuntu0.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/python3-git<3.1.24-1ubuntu0.1~esm2
3.1.24-1ubuntu0.1~esm2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/python3-git<3.0.7-1ubuntu0.1~esm2
3.0.7-1ubuntu0.1~esm2
Ubuntu Ubuntu=20.04
All of the following
ubuntu/python-git<2.1.8-1ubuntu0.1~esm2
2.1.8-1ubuntu0.1~esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/python3-git<2.1.8-1ubuntu0.1~esm2
2.1.8-1ubuntu0.1~esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/python-git<1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2
1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2
Ubuntu Ubuntu=16.04
All of the following
ubuntu/python3-git<1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2
1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2
Ubuntu Ubuntu=16.04
All of the following
ubuntu/python-git<0.3.2~RC1-3ubuntu0.1~esm2
0.3.2~RC1-3ubuntu0.1~esm2
Ubuntu Ubuntu=14.04
Event History
Aug 31, 2023
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-6326-1?
The severity of USN-6326-1 is considered high due to the potential for arbitrary command execution on the host.
2
How do I fix USN-6326-1?
To fix USN-6326-1, update to the patched versions of the affected packages as specified in the advisory.
3
Which packages are affected by USN-6326-1?
USN-6326-1 impacts various versions of the python3-git and python-git packages across multiple Ubuntu releases.
4
What is the impact of the vulnerability in USN-6326-1?
The vulnerability in USN-6326-1 can allow an attacker to execute arbitrary commands on the host machine.
5
Is there a known exploit for USN-6326-1?
As of now, there are no widely reported exploits publicly available for the vulnerability described in USN-6326-1.