Path traversal in GitPython - CVE-2023-41040

Vulnerability identifier: #VU81056

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-41040

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when reading from the ".git" directory. A remote attacker can prepare a specially crafted ".git" file with directory traversal characters in file names and force the application to read these files from the local system. This can result in checking for existence of a specific files on the system or perform a denial of service (DoS) attack.

GitPython
IBM Cloud Pak for Multicloud Management
Ansible Automation Platform
IBM Process Mining
Fedora
Ubuntu
openEuler
python-git (Ubuntu package)
receptor (Red Hat package)
ansible-runner (Red Hat package)
ansible-core (Red Hat package)
python3x-dynaconf (Red Hat package)
python-dynaconf (Red Hat package)
GitPython
python-GitPython
python3-GitPython
python-GitPython-help
python3x-gitpython (Red Hat package)
python-gitpython (Red Hat package)
python3x-aiohttp (Red Hat package)
python-aiohttp (Red Hat package)
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
python3x-django (Red Hat package)
python-django (Red Hat package)
automation-controller (Red Hat package)
python3x-twisted (Red Hat package)
python-twisted (Red Hat package)

Install update from vendor's website.

GitPython - update to 3.1.37
IBM Cloud Pak for Multicloud Management - update to 2.3.8
python-git (Ubuntu package) - addressed in versions 0.3.2~RC1-3ubuntu0.1~esm3, 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4, 2.1.8-1ubuntu0.1~esm4, 3.0.7-1ubuntu0.1~esm4, 3.1.24-1ubuntu0.1~esm3, 3.1.37-3ubuntu0.1~esm2, 3.1.46-1ubuntu0.1~esm1
receptor (Red Hat package) - addressed in versions 1.4.5-1.el8ap, 1.4.5-1.el9ap
IBM Process Mining - update to 1.14.2.0.1
ansible-runner (Red Hat package) - addressed in versions 2.3.6-1.el8ap, 2.3.6-1.el9ap
ansible-core (Red Hat package) - addressed in versions 2.15.10-1.el8ap, 2.15.10-1.el9ap
python3x-dynaconf (Red Hat package) - update to 3.1.12-2.el8ap
python-dynaconf (Red Hat package) - update to 3.1.12-2.el9ap
GitPython - addressed in versions 3.1.18-3.el8, 3.1.40-1.fc40
python-GitPython - update to 3.1.32-2
python3-GitPython - update to 3.1.32-2
python-GitPython-help - update to 3.1.32-2
python3x-gitpython (Red Hat package) - update to 3.1.40-1.el8ap
python-gitpython (Red Hat package) - update to 3.1.40-1.el9ap
python3x-aiohttp (Red Hat package) - update to 3.9.3-1.el8ap
python-aiohttp (Red Hat package) - update to 3.9.3-1.el9ap
python3x-pulpcore (Red Hat package) - update to 3.28.24-1.el8ap
python-pulpcore (Red Hat package) - update to 3.28.24-1.el9ap
python3x-django (Red Hat package) - update to 4.2.11-1.el8ap
python-django (Red Hat package) - update to 4.2.11-1.el9ap
automation-controller (Red Hat package) - addressed in versions 4.5.5-2.el8ap, 4.5.5-2.el9ap
python3x-twisted (Red Hat package) - update to 23.10.0-1.el8ap
python-twisted (Red Hat package) - update to 23.10.0-1.el9ap

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-cwvm-v4w8-q58c
• https://github.com/gitpython-developers/GitPython/blob/1c8310d7cae144f74a671cbe17e51f63a830adbf/git/refs/symbolic.py#L174-L175

• Path traversal in GitPython
• Multiple vulnerabilities in IBM Process Mining
• Fedora 40 update for GitPython
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• openEuler update for python-GitPython
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Fedora EPEL 8 update for GitPython
• Ubuntu update for python-git