CVE-2024-22190

EUVD-2024-0062
GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub_MCNA
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
Affected Products (NVD)
VendorProductVersion
gitpython_projectgitpython
𝑥
< 3.1.41
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-git
bookworm
3.1.30-1+deb12u2
fixed
bullseye
3.1.14-1
fixed
bullseye (security)
3.1.14-1+deb11u1
fixed
forky
3.1.45-1
fixed
sid
3.1.45-1
fixed
trixie
3.1.44-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-git
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
lunar
ignored
mantic
ignored
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
trusty
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/gitpython-developers/GitPython/commit/ef3192cc414f2fd9978908454f6fd95243784c7f
https://github.com/gitpython-developers/GitPython/pull/1792
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx
https://github.com/gitpython-developers/GitPython/commit/ef3192cc414f2fd9978908454f6fd95243784c7f
https://github.com/gitpython-developers/GitPython/pull/1792
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx