Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk:High] Upgrade gitpython(due by 01/7/2023) #728

Closed
cnlucas opened this issue Dec 7, 2022 · 2 comments · Fixed by #737
Closed

[Snyk:High] Upgrade gitpython(due by 01/7/2023) #728

cnlucas opened this issue Dec 7, 2022 · 2 comments · Fixed by #737
Assignees
@cnlucas
Labels
Security: general General security concern or issue Security: high Remediate within 30 days
Milestone
Sprint 20.3

Comments

@cnlucas
Copy link
Member

cnlucas commented Dec 7, 2022

Introduced through
gitpython@3.1.27

Exploit maturity
No known exploit

Detailed paths

Introduced through: project@0.0.0 › gitpython@3.1.27
Fix: No remediation path available.

Security information
Factors contributing to the scoring:

Snyk: [CVSS 8.1](https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858) - High Severity
NVD: Not available. NVD has not yet published its analysis.

Why are the scores different? Learn how Snyk evaluates vulnerability scores
Overview

GitPython is a python library used to interact with Git repositories

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
@cnlucas cnlucas added Security: high Remediate within 30 days Security: general General security concern or issue labels Dec 7, 2022
@cnlucas cnlucas added this to the Sprint 20.1 milestone Dec 7, 2022
@cnlucas cnlucas self-assigned this Dec 7, 2022
@pkfec
Copy link
Contributor

pkfec commented Dec 12, 2022

Related #gitpython-developers/GitPython#1515

@cnlucas cnlucas mentioned this issue Dec 14, 2022
Closed
1 task
@pkfec pkfec modified the milestones: Sprint 20.1, Sprint 20.2 Dec 20, 2022
@cnlucas cnlucas mentioned this issue Dec 21, 2022
Closed
@cnlucas cnlucas mentioned this issue Dec 28, 2022
Closed
1 task
@cnlucas cnlucas modified the milestones: Sprint 20.2, Sprint 20.3 Dec 30, 2022
@pkfec
Copy link
Contributor

pkfec commented Jan 3, 2023

A newer version of Gitpython v3.1.30 is released on 12/29/2022 and is available here GitPython v3.1.30

@cnlucas cnlucas mentioned this issue Jan 3, 2023
Merged
@pkfec pkfec closed this as completed in #737 Jan 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@cnlucas cnlucas

Labels
Security: general General security concern or issue Security: high Remediate within 30 days
Projects
None yet
Milestone
Sprint 20.3
Development

Successfully merging a pull request may close this issue.

728-upgrade gitpython fecgov/fec-eregs
2 participants
@pkfec @cnlucas