Log in Start free

Vulnerability · Published Dec 12, 2022 · Assigned by snyk

CVE-2022-24439Remote Code Execution (RCE)

High 8.1

In plain English

A high-severity security flaw in GitPython. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.1% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)6.1%top 6.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-git3.1.30-1DEBIAN-CVE-2022-24439
Debian:13python-git3.1.30-1DEBIAN-CVE-2022-24439
Debian:14python-git3.1.30-1DEBIAN-CVE-2022-24439
PyPIgitpython3.1.30GHSA-hcpj-qp55-gfph
PyPIgitpython3.1.30PYSEC-2022-42992

Affected products (as reported)

VendorProductVersions
n/a GitPython 0 – before unspecified

References