[USN-6326-1] GitPython vulnerability

[Fabian Toepfer]

==========================================================================
Ubuntu Security Notice USN-6326-1
August 31, 2023

python-git vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.04 LTS (Available with Ubuntu Pro)
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

GitPython could be made to run arbitrary commands on the host.

Software Description:
- python-git: Python library to interact with Git repositories

Details:

It was discovered that GitPython did not block insecure options from user
inputs in the clone command. An attacker could possibly use this issue to
execute arbitrary commands on the host.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   python3-git                     3.1.30-1ubuntu0.23.04.1

Ubuntu 22.04 LTS (Available with Ubuntu Pro):
   python3-git                     3.1.24-1ubuntu0.1~esm2

Ubuntu 20.04 LTS (Available with Ubuntu Pro):
   python3-git                     3.0.7-1ubuntu0.1~esm2

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
   python-git                      2.1.8-1ubuntu0.1~esm2
   python3-git                     2.1.8-1ubuntu0.1~esm2

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
   python-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2
   python3-git 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
   python-git                      0.3.2~RC1-3ubuntu0.1~esm2

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6326-1
   CVE-2023-40267

Package Information:
https://launchpad.net/ubuntu/+source/python-git/3.1.30-1ubuntu0.23.04.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20230831/64cbec20/attachment-0001.sig>