Stay Secure with the Latest Linux Advisories

security advisorycommand executionubuntu

Ubuntu 23.04 USN-6326-1 Severe: GitPython Command Execution Risk

GitPython could be made to run arbitrary commands on the host.. ========================================================================== Ubuntu Security Notice USN-6326-1 August 31, 2023 python-git vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 - Ubuntu 22.04 LTS (Available with Ubuntu Pro) - Ubuntu 20.04 LTS (Available with Ubuntu Pro) - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: GitPython could be made to run arbitrary commands on the host. Software Description: - python-git: Python library to interact with Git repositories Details: It was discovered that GitPython did not block insecure options from user inputs in the clone command. An attacker could possibly use this issue to execute arbitrary commands on the host. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: python3-git 3.1.30-1ubuntu0.23.04.1 Ubuntu 22.04 LTS (Available with Ubuntu Pro): python3-git 3.1.24-1ubuntu0.1~esm2 Ubuntu 20.04 LTS (Available with Ubuntu Pro): python3-git 3.0.7-1ubuntu0.1~esm2 Ubuntu 18.04 LTS (Available with Ubuntu Pro): python-git 2.1.8-1ubuntu0.1~esm2 python3-git 2.1.8-1ubuntu0.1~esm2 Ubuntu 16.04 LTS (Available with Ubuntu Pro): python-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2 python3-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2 Ubuntu 14.04 LTS (Available with Ubuntu Pro): python-git 0.3.2~RC1-3ubuntu0.1~esm2 In general, a standard system update will make all the necessarychanges. References: https://ubuntu.com/security/notices/USN-6326-1 CVE-2023-40267 Package Information: https://launchpad.net/ubuntu/+source/python-git/3.1.30-1ubuntu0.23.04.1 . Ubuntu Security Notice USN-6326-2 addresses a severe vulnerability in GitPython that permits unauthorized command execution.. GitPython, Command Execution, Software Update, Security Notice. . Severity: Critical. LinuxSecurity.com Team

Aug 31, 2023 •Critical Ubuntu