You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run git, as well as when it runs bash.exe to interpret hooks. If either of those features are used on Windows, a malicious git.exe or bash.exe may be run from an untrusted repository. This issue has been patched in version 3.1.41.
CVE-2024-22190 - High Severity Vulnerability
Vulnerable Library - GitPython-3.1.29-py3-none-any.whl
GitPython is a Python library used to interact with Git repositories
Library home page: https://files.pythonhosted.org/packages/1f/d3/020efb312a7d25fa00e144497a33378d415552e5581be080a99017af6d39/GitPython-3.1.29-py3-none-any.whl
Path to dependency file: /docs/requirements.txt
Path to vulnerable library: /docs/requirements.txt,/docs/requirements.txt,/tmp/ws-scm/java-patterns
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run
git
, as well as when it runsbash.exe
to interpret hooks. If either of those features are used on Windows, a maliciousgit.exe
orbash.exe
may be run from an untrusted repository. This issue has been patched in version 3.1.41.Publish Date: 2024-01-11
URL: CVE-2024-22190
CVSS 3 Score Details (7.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-22190
Release Date: 2024-01-11
Fix Resolution: GitPython - 3.1.41
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: