==========================================================================
Ubuntu Security Notice USN-6326-1
August 31, 2023

python-git vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.04 LTS (Available with Ubuntu Pro)
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

GitPython could be made to run arbitrary commands on the host.

Software Description:
- python-git: Python library to interact with Git repositories

Details:

It was discovered that GitPython did not block insecure options from user
inputs in the clone command. An attacker could possibly use this issue to
execute arbitrary commands on the host.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   python3-git                     3.1.30-1ubuntu0.23.04.1

Ubuntu 22.04 LTS (Available with Ubuntu Pro):
   python3-git                     3.1.24-1ubuntu0.1~esm2

Ubuntu 20.04 LTS (Available with Ubuntu Pro):
   python3-git                     3.0.7-1ubuntu0.1~esm2

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   python-git                      2.1.8-1ubuntu0.1~esm2
   python3-git                     2.1.8-1ubuntu0.1~esm2

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   python-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2
   python3-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
   python-git                      0.3.2~RC1-3ubuntu0.1~esm2

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6326-1
   CVE-2023-40267

Package Information:
https://launchpad.net/ubuntu/+source/python-git/3.1.30-1ubuntu0.23.04.1

Ubuntu 6326-1: GitPython vulnerability

August 31, 2023
GitPython could be made to run arbitrary commands on the host.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 - Ubuntu 22.04 LTS (Available with Ubuntu Pro) - Ubuntu 20.04 LTS (Available with Ubuntu Pro) - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: GitPython could be made to run arbitrary commands on the host. Software Description: - python-git: Python library to interact with Git repositories Details: It was discovered that GitPython did not block insecure options from user inputs in the clone command. An attacker could possibly use this issue to execute arbitrary commands on the host.

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04:   python3-git                     3.1.30-1ubuntu0.23.04.1 Ubuntu 22.04 LTS (Available with Ubuntu Pro):   python3-git                     3.1.24-1ubuntu0.1~esm2 Ubuntu 20.04 LTS (Available with Ubuntu Pro):   python3-git                     3.0.7-1ubuntu0.1~esm2 Ubuntu 18.04 LTS (Available with Ubuntu Pro):   python-git                      2.1.8-1ubuntu0.1~esm2   python3-git                     2.1.8-1ubuntu0.1~esm2 Ubuntu 16.04 LTS (Available with Ubuntu Pro):   python-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2   python3-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2 Ubuntu 14.04 LTS (Available with Ubuntu Pro):   python-git                      0.3.2~RC1-3ubuntu0.1~esm2 In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-6326-1

  CVE-2023-40267

Severity
Ubuntu Security Notice USN-6326-1

Package Information

https://launchpad.net/ubuntu/+source/python-git/3.1.30-1ubuntu0.23.04.1

Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo