Description

igirardi

opened on Aug 30, 2023

Issue body actions

This appeared in the CVE additional information here GHSA-wfm5-v35h-vwf4.

I found it reported already. I am reporting it here just in case.

Reacted by Kurt von Laven, Amos Syuma, Adrian Dischinger, Daisuke Hashimoto and Eliah Kagan

Activity

1. igirardi

   changed the title [-]CVE-2023-40267: Remote Code Execution (RCE) [/-] [+]CVE-2023-40590: Remote Code Execution (RCE) [/+] on Aug 30, 2023
2. igirardi

   changed the title [-]CVE-2023-40590: Remote Code Execution (RCE) [/-] [+]CVE-2023-40590: Untrusted search path on Windows systems leading to arbitrary code execution [/+] on Aug 30, 2023
3. Byron commented on Aug 30, 2023

   

   Byron

   on Aug 30, 2023

   Member

   More actions

   Thanks. This advisory originated in this repository and is thus known: GHSA-wfm5-v35h-vwf4 .

   However, it seems hard to communicate using an advisory, so we can keep this issue open to collect comments.

   Reacted by Eliah Kagan
4. Byron

   added

   acknowledged

   help wanted

   tag.Windows

   on Aug 30, 2023
5. ThunderKey

   added a commit that references this issue on Aug 30, 2023

   ignore CVE that is not yet fixed in the package

   a2c2cd1
6. stsewd commented on Aug 30, 2023

   

   stsewd

   on Aug 30, 2023

   Contributor

   More actions

   BTW, there is another vulnerability that was reported, that is also pending a fix GHSA-cwvm-v4w8-q58c. Looks like a CVE wasn't requested for that one.
7. Byron commented on Aug 30, 2023

   

   Byron

   on Aug 30, 2023

   Member

   More actions

   I thought for something less critical, it wouldn't be worth a whole CVE entry.
   As collaborator (and author) of the GHSA, are you able to request a CVE? If so, please go ahead if you think there should be one. Otherwise I will do it as per your request. Thanks.
8. stsewd commented on Aug 30, 2023

   

   stsewd

   on Aug 30, 2023

   Contributor

   More actions

   @Byron only maintainers can request CVEs. If this was intentional, I don't mind having no CVE for that advisory 👍, I was suggesting it since it looks like people are more pending on CVEs than plain advisories (or that seems to me). We could also create a new issue linking to the advisory, so people are more aware of it.
9. Byron commented on Aug 30, 2023

   

   Byron

   on Aug 30, 2023

   Member

   More actions

   I am happy to follow your advise and requested a CVE. It should increase visibility and with that, the chance for a fix.

   Reacted by Santos Gallegos, Eliah Kagan and igirardi
10. Byron

    closed this as completedin #1636on Sep 1, 2023
11. Byron

    added this to the v3.1.33 - Bugfixes milestone on Sep 1, 2023
12. Byron commented on Sep 1, 2023

    

    Byron

    on Sep 1, 2023

    Member

    More actions

    The fix was released here: https://pypi.org/project/GitPython/3.1.33/

    Reacted by offa, Eliah Kagan, Adrian Dischinger and igirardi

    Reacted by offa, Eliah Kagan, igirardi and Kurt von Laven

Issue actions