Ubuntu 23.04 USN-6326-1 Severe: GitPython Command Execution Risk
ubuntu
August 31, 2023
GitPython could be made to run arbitrary commands on the host.
Summary
GitPython could be made to run arbitrary commands on the host.
Software Description:
- python-git: Python library to interact with Git repositories
Details:
It was discovered that GitPython did not block insecure options from user
inputs in the clone command. An attacker could possibly use this issue to
execute arbitrary commands on the host.
Topics Covered
Update Instructions
The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: python3-git 3.1.30-1ubuntu0.23.04.1 Ubuntu 22.04 LTS (Available with Ubuntu Pro): python3-git 3.1.24-1ubuntu0.1~esm2 Ubuntu 20.04 LTS (Available with Ubuntu Pro): python3-git 3.0.7-1ubuntu0.1~esm2 Ubuntu 18.04 LTS (Available with Ubuntu Pro): python-git 2.1.8-1ubuntu0.1~esm2 python3-git 2.1.8-1ubuntu0.1~esm2 Ubuntu 16.04 LTS (Available with Ubuntu Pro): python-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2 python3-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2 Ubuntu 14.04 LTS (Available with Ubuntu Pro): python-git 0.3.2~RC1-3ubuntu0.1~esm2 In general, a standard system update will make all the necessary changes.
References
https://ubuntu.com/security/notices/USN-6326-1
CVE-2023-40267
PREVIOUS
NEXT
Severity
critical
Lowest
Low
Medium
High
Critical
Ubuntu Security Notice USN-6326-1
Topics Covered
Package Information
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!