SB20260914112 - openEuler 24.03 LTS SP1 update for python-GitPython

Description

This security bulletin contains information about 5 vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2026-67322)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in Repo.clone_from() and Git.polish_url() when processing an attacker-controlled clone URL. A remote attacker can supply a crafted URL containing environment-variable tokens to disclose sensitive information.

The issue affects non-Cygwin platforms, where environment-variable expansion is applied to the clone URL before it is passed to git clone.

2) Command injection (CVE-ID: CVE-2026-67323)

CWE-ID: CWE-77 - Command injection

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary commands.

The vulnerability exists due to command injection in Repo.archive() and git.ls_remote() when processing caller-supplied Git options. A remote attacker can supply crafted option values such as exec or upload_pack to execute arbitrary commands.

The command execution occurs under default Git configuration.

3) OS Command Injection (CVE-ID: CVE-2026-67324)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute a local command.

The vulnerability exists due to improper neutralization of special elements used in an os command in the Repo.clone_from unsafe clone option gate when processing attacker-influenced clone options in multi_options. A remote user can supply a joined short option such as -u<helper> to execute a local command.

Exploitation requires an application to pass attacker-influenced clone options into Repo.clone_from(..., multi_options=...) while relying on the default unsafe-option gate to block unsafe clone options.

4) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-67325)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to incomplete list of disallowed inputs in the check_unsafe_options option validation in GitPython when processing attacker-controlled keyword argument keys for git clone, fetch, pull, or push operations. A remote user can supply a specially crafted abbreviated long option to execute arbitrary code.

Exploitation requires a host application to pass attacker-controlled keyword argument keys into affected GitPython operations while using the default unsafe-option protection.

5) Input validation error (CVE-ID: CVE-2026-67326)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in config_writer() and set_value() in git/config.py when processing a crafted section parameter containing newline characters. A remote attacker can supply a crafted section name to inject arbitrary section headers into .git/config and execute arbitrary code.

User interaction is required to trigger a git hook after the malicious configuration is written.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3250