Description

EliahKagan

opened on Aug 31, 2023

Issue body actions

This issue is for tracking the public vulnerability CVE-2023-41040:

In order to resolve some git references, GitPython reads files from the .git directory, in some places the name of the file being read is provided by the user, GitPython doesn't check if this file is located outside the .git directory. This allows an attacker to make GitPython read any file from the system.

Further details, including example code, are in CVE-2023-41040.

(I'm opening this issue based on the idea in #1635 (comment) that it's useful to have issues for these. This CVE has been mentioned in #1635, but if #1636 is merged then #1635 may be closed. #1636 fixes CVE-2023-40590 but does not also fix CVE-2023-41040.)

Reacted by Kurt von Laven, igirardi, Dave Brondsema and Luke Hsiao

Activity

1. Byron

   added

   acknowledged

   help wanted

   on Sep 1, 2023
2. EliahKagan commented on Sep 1, 2023

   

   EliahKagan

   on Sep 1, 2023 · Hidden as resolved

   Author

   show commentMore actions
3. stsewd commented on Sep 2, 2023

   

   stsewd

   on Sep 2, 2023

   Contributor

   More actions

   I went ahead and updated the versions in the local advisories. The global advisories, one is being updated at github/advisory-database#2695, for the other one I can suggest an update at github/advisory-database#2690.

   Reacted by Eliah Kagan
4. facutuesca commented on Sep 5, 2023

   

   facutuesca

   on Sep 5, 2023

   Contributor

   More actions

   @EliahKagan I created a PR with a possible fix for the issue

   Reacted by Eliah Kagan
5. Byron

   closed this as completedin #1644on Sep 7, 2023
6. plannigan commented on Sep 9, 2023

   

   plannigan

   on Sep 9, 2023

   More actions

   It looks like the GitHub advisory was updated with the patched version information. However, the repository advisory does not show the patched version information (not sure why there is a difference).

   Reacted by Eliah Kagan
7. stsewd commented on Sep 9, 2023

   

   stsewd

   on Sep 9, 2023

   Contributor

   More actions

   Updated 👍

   There are two types of advisories, local and global, GitHub updates the global ones, and maintainers (and looks like reporters too) can update the local ones.

   Reacted by Eliah Kagan

Issue actions