[USN-6326-1] GitPython vulnerability
==========================================================================
Ubuntu Security Notice USN-6326-1
August 31, 2023
python-git vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.04
- Ubuntu 22.04 LTS (Available with Ubuntu Pro)
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)
Summary:
GitPython could be made to run arbitrary commands on the host.
Software Description:
- python-git: Python library to interact with Git repositories
Details:
It was discovered that GitPython did not block insecure options from user
inputs in the clone command. An attacker could possibly use this issue to
execute arbitrary commands on the host.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.04:
python3-git 3.1.30-1ubuntu0.23.04.1
Ubuntu 22.04 LTS (Available with Ubuntu Pro):
python3-git 3.1.24-1ubuntu0.1~esm2
Ubuntu 20.04 LTS (Available with Ubuntu Pro):
python3-git 3.0.7-1ubuntu0.1~esm2
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
python-git 2.1.8-1ubuntu0.1~esm2
python3-git 2.1.8-1ubuntu0.1~esm2
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
python-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2
python3-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2
Ubuntu 14.04 LTS (Available with Ubuntu Pro):
python-git 0.3.2~RC1-3ubuntu0.1~esm2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6326-1
CVE-2023-40267
Package Information:
https://launchpad.net/ubuntu/+source/python-git/3.1.30-1ubuntu0.23.04.1
A GitPython security update has been released for Ubuntu Linux 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 23.04.
