CVE-2023-41040: GitPython blind local file inclusion
(updated )
In order to resolve some git references, GitPython reads files from the .git directory, in some places the name of the file being read is provided by the user, GitPython doesn’t check if this file is located outside the .git directory. This allows an attacker to make GitPython read any file from the system.
References
- github.com/advisories/GHSA-cwvm-v4w8-q58c
- github.com/gitpython-developers/GitPython
- github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py
- github.com/gitpython-developers/GitPython/commit/74e55ee4544867e1bd976b7df5a45869ee397b0b
- github.com/gitpython-developers/GitPython/commit/e98f57b81f792f0f5e18d33ee658ae395f9aa3c4
- github.com/gitpython-developers/GitPython/pull/1672
- github.com/gitpython-developers/GitPython/releases/tag/3.1.37
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c
- github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2023-165.yaml
- lists.debian.org/debian-lts-announce/2023/09/msg00036.html
- nvd.nist.gov/vuln/detail/CVE-2023-41040
Detect and mitigate CVE-2023-41040 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →