MGASA-2023-0001 - Updated python-gitpython packages fix security vulnerability Publication date: 13 Jan 2023 URL: https://advisories.mageia.org/MGASA-2023-0001.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-24439 Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments. This is only relevant when enabling the ext transport protocol (CVE-2022-24439) References: - https://bugs.mageia.org/show_bug.cgi?id=31242 - https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858 - https://lists.fedoraproject.org/archives/list/[email protected]/thread/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24439 SRPMS: - 8/core/python-gitpython-3.1.30-1.mga8
Mageia 2023-0001: python-gitpython security update
Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command
Summary
Remote Code Execution (RCE) due to improper user input validation, which
makes it possible to inject a maliciously crafted remote URL into the
clone command. Exploiting this vulnerability is possible because the
library makes external calls to git without sufficient sanitization of
input arguments. This is only relevant when enabling the ext transport
protocol (CVE-2022-24439)
References
- https://bugs.mageia.org/show_bug.cgi?id=31242
- https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858
- https://lists.fedoraproject.org/archives/list/[email protected]/thread/IKMVYKLWX62UEYKAN64RUZMOIAMZM5JN/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24439
Resolution
MGASA-2023-0001 - Updated python-gitpython packages fix security vulnerability
SRPMS
- 8/core/python-gitpython-3.1.30-1.mga8
Severity
Publication date: 13 Jan 2023
URL: https://advisories.mageia.org/MGASA-2023-0001.html
Type: security
CVE: CVE-2022-24439
News
HOWTOs
Features
How to Check if Your Linux System is Infected with a Virus
Security Considerations for Azure Linux & Windows Subsystem for Linux Users
Admins Receive Automated Linux Patch Management & Improved Security with ManageEngine Endpoint Central
Linux Malware: The Truth About This Growing Threat [Updated]
How Physical Security Blends With Cybersecurity
About Us
Powered By
