GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Fix CVE-2023-40590 by EliahKagan · Pull Request #1636 · gitpython-developers/GitPython

Conversation

EliahKagan commented Aug 30, 2023 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Fixes #1635

This fixes the path search bug where the current directory is included on Windows, by setting NoDefaultCurrentDirectoryInExePath for the caller. (Setting for the callee env would not work.)

This sets it only on Windows, only for the duration of the Popen call, and then automatically unsets it or restores its old value.

NoDefaultCurrentDirectoryInExePath is documented in NeedCurrentDirectoryForExePathW function (processenv.h). See also this SO post by Mofi.

It automatically affects the behavior of subprocess.Popen on Windows, due to the way Popen uses the Windows API. (In contrast, it does not, at least currently on CPython, affect the behavior of shutil.which. But shutil.which is not being used to find git.exe. [Edit: To avoid misleading people who find this by searching, I should mention that, starting in Python 3.12, shutil.which now checks this as well.])

I have tested this by naming a hello world program git.exe and placing it in the current directory, verifying that import git produces an expected error (my hello world program does not provide Git operations), then applying this change and verifying that import git works as it should.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

stsewd, Kurt-von-Laven, and per1234 reacted with hooray emoji

All reactions

🎉 3 reactions

This comment was marked as resolved.

EliahKagan force-pushed the cve-2023-40590 branch 2 times, most recently from 5e77467 to 9f1b4bc Compare

August 30, 2023 13:43


          Fix CVE-2023-40590

This fixes the path search bug where the current directory is
included on Windows, by setting NoDefaultCurrentDirectoryInExePath
for the caller. (Setting for the callee env would not work.)

This sets it only on Windows, only for the duration of the Popen
call, and then automatically unsets it or restores its old value.

NoDefaultCurrentDirectoryInExePath is documented at:
https://learn.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-needcurrentdirectoryforexepathw

It automatically affects the behavior of subprocess.Popen on
Windows, due to the way Popen uses the Windows API. (In contrast,
it does not, at least currently on CPython, affect the behavior of
shutil.which. But shutil.which is not being used to find git.exe.)

EliahKagan force-pushed the cve-2023-40590 branch from 9f1b4bc to 6029211 Compare

August 30, 2023 14:01

Byron commented Aug 30, 2023

Copy link

Copy Markdown

Member

Thanks a lot!

Could we also have a test for this?

I could imagine that a test could be as simple as dropping a git.exe file into a freshly initialized git repository. When invoking any repo.git(…) command, this should fail on windows as it picks up and tries to execute the dummy file. With the fix, it should not fail. For good measure, on linux one can probably create an executable file called git instead, which shouldn't be picked up by default.

What do you think?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

EliahKagan commented Aug 30, 2023 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member Author

@Byron Yes, I will add a test.

I think the test could be even simpler. The existing test test_it_executes_git_to_shell_and_returns_result calls git.execute directly, and does not have to be run in a git repository. I wouldn't change that test, but a new one like it could be added that temporarily changes directory into a temporary directory with a dummy git.exe (or executable git on non-Windows systems).

Would that be reasonable, or would you prefer a higher level repo.git test?

The other thing that occurs to me is that the test might be considered slightly more robust if it uses a binary file as git.exe that is actually executable. I'm not sure if this is worthwhile or not. (On Windows, hostname.exe could be copied from the System32 directory as git.exe to serve this purpose.)

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

EliahKagan commented Aug 30, 2023 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member Author

I've added a test, which I've verified locally fails before the fix and passes afterwards, on Windows. ~~I have not yet run it on other operating systems, so there may be bugs in my test on that code path that I will have to fix.~~ I have also run it on Ubuntu, where it passes.

I've taken the approach I suggested above. But I'm willing to make any requested changes, including to the specific way you have suggested if you would prefer that.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.


          Add a unit test for CVE-2023-40590

94e0fb0

This adds test_it_executes_git_not_from_cwd to verify that the
execute method does not use "git.exe" in the current directory on
Windows, nor "git" in the current directory on Unix-like systems,
when those files are executable.

It adds a _chdir helper context manager to support this, because
contextlib.chdir is only available on Python 3.11 and later.

EliahKagan force-pushed the cve-2023-40590 branch from fd892df to 94e0fb0 Compare

August 30, 2023 16:08

Byron requested changes

Aug 30, 2023

View reviewed changes

Byron left a comment

Copy link

Copy Markdown

Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the test!

Even though I am a bit uneasy about changing the directory of the test-process, I understand that tests aren't run in parallel so it should be fine for the foreseeable future.

Besides one small nit that hopefully prevents this test to fail with unexpected git versions, this PR is ready to be merged.

Thanks again for your help with this.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

jgarzon-ppro, AdrianDsg, and EliahKagan reacted with hooray emoji

All reactions

🎉 3 reactions

Comment thread

test/test_git.py Resolved

Uh oh!

There was an error while loading. Please reload this page.


          Don't check form of version number

7611cd9

This changes the regex in test_it_executes_git_not_from_cwd so
that (unlike test_it_executes_git_to_shell_and_returns_result) it
only checks that the output starts with the words "git version",
and not the form of whatever follows those words.

xesf commented Aug 31, 2023

Copy link

Copy Markdown

Any idea when a patch release can be made with this fix?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

EliahKagan commented Aug 31, 2023

Copy link

Copy Markdown

Member Author

@Byron Is this ready to go?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

EliahKagan mentioned this pull request

Aug 31, 2023

CVE-2023-41040: Blind local file inclusion #1638

Closed

Byron merged commit 8b75434 into gitpython-developers:main

Sep 1, 2023

Byron added this to the v3.1.33 - Bugfixes milestone

Sep 1, 2023

EliahKagan deleted the cve-2023-40590 branch

September 1, 2023 06:46

xesf commented Sep 1, 2023

Copy link

Copy Markdown

Thanks guys, I appreciate the promptness.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

renovate Bot referenced this pull request in allenporter/flux-local

Sep 4, 2023


          Update dependency GitPython to v3.1.34 (#320)

6a0c4f9

[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [GitPython](https://togithub.com/gitpython-developers/GitPython) |
`==3.1.32` -> `==3.1.34` |
[![age](https://developer.mend.io/api/mc/badges/age/pypi/GitPython/3.1.34?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/pypi/GitPython/3.1.34?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/pypi/GitPython/3.1.32/3.1.34?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/GitPython/3.1.32/3.1.34?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>gitpython-developers/GitPython (GitPython)</summary>

###
[`v3.1.34`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.34):
- fix resource leaking

[Compare
Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.33...3.1.34)

##### What's Changed

- util: close lockfile after opening successfully by
[@&#8203;skshetry](https://togithub.com/skshetry) in
[https://github.com/gitpython-developers/GitPython/pull/1639](https://togithub.com/gitpython-developers/GitPython/pull/1639)

##### New Contributors

- [@&#8203;skshetry](https://togithub.com/skshetry) made their first
contribution in
[https://github.com/gitpython-developers/GitPython/pull/1639](https://togithub.com/gitpython-developers/GitPython/pull/1639)

**Full Changelog**:
gitpython-developers/GitPython@3.1.33...3.1.34

###
[`v3.1.33`](https://togithub.com/gitpython-developers/GitPython/releases/tag/3.1.33):
- with security fix

[Compare
Source](https://togithub.com/gitpython-developers/GitPython/compare/3.1.32...3.1.33)

##### What's Changed

- WIP Quick doc by [@&#8203;LeoDaCoda](https://togithub.com/LeoDaCoda)
in
[https://github.com/gitpython-developers/GitPython/pull/1608](https://togithub.com/gitpython-developers/GitPython/pull/1608)
- Partial clean up wrt mypy and black by
[@&#8203;bodograumann](https://togithub.com/bodograumann) in
[https://github.com/gitpython-developers/GitPython/pull/1617](https://togithub.com/gitpython-developers/GitPython/pull/1617)
- Disable merge_includes in config writers by
[@&#8203;bodograumann](https://togithub.com/bodograumann) in
[https://github.com/gitpython-developers/GitPython/pull/1618](https://togithub.com/gitpython-developers/GitPython/pull/1618)
- feat: full typing for "progress" parameter in Repo class by
[@&#8203;madebylydia](https://togithub.com/madebylydia) in
[https://github.com/gitpython-developers/GitPython/pull/1634](https://togithub.com/gitpython-developers/GitPython/pull/1634)
- Fix CVE-2023-40590 by
[@&#8203;EliahKagan](https://togithub.com/EliahKagan) in
[https://github.com/gitpython-developers/GitPython/pull/1636](https://togithub.com/gitpython-developers/GitPython/pull/1636)
-
[#&#8203;1566](https://togithub.com/gitpython-developers/GitPython/issues/1566)
Creating a lock now uses python built-in "open()" method to work arou…
by [@&#8203;HageMaster3108](https://togithub.com/HageMaster3108) in
[https://github.com/gitpython-developers/GitPython/pull/1619](https://togithub.com/gitpython-developers/GitPython/pull/1619)

##### New Contributors

- [@&#8203;LeoDaCoda](https://togithub.com/LeoDaCoda) made their first
contribution in
[https://github.com/gitpython-developers/GitPython/pull/1608](https://togithub.com/gitpython-developers/GitPython/pull/1608)
- [@&#8203;bodograumann](https://togithub.com/bodograumann) made their
first contribution in
[https://github.com/gitpython-developers/GitPython/pull/1617](https://togithub.com/gitpython-developers/GitPython/pull/1617)
- [@&#8203;EliahKagan](https://togithub.com/EliahKagan) made their first
contribution in
[https://github.com/gitpython-developers/GitPython/pull/1636](https://togithub.com/gitpython-developers/GitPython/pull/1636)
- [@&#8203;HageMaster3108](https://togithub.com/HageMaster3108) made
their first contribution in
[https://github.com/gitpython-developers/GitPython/pull/1619](https://togithub.com/gitpython-developers/GitPython/pull/1619)

**Full Changelog**:
gitpython-developers/GitPython@3.1.32...3.1.33

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/allenporter/flux-local).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi43OC44IiwidXBkYXRlZEluVmVyIjoiMzYuNzguOCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

roskakori mentioned this pull request

Sep 6, 2023

Address CVE-2023-40590 roskakori/pygount#126

Closed

1 task done

xesf commented Sep 7, 2023

Copy link

Copy Markdown

Looks like this issue is still present in the 3.1.34 version and has been reported overnight
GHSA-cwvm-v4w8-q58c

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

EliahKagan commented Sep 7, 2023

Copy link

Copy Markdown

Member Author

@xesf That's a separate vulnerability, CVE-2023-41040 (#1638, #1644). This PR only fixed CVE-2023-40590 (#1635).

xesf reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

xesf commented Sep 7, 2023

Copy link

Copy Markdown

Thanks @EliahKagan for the details.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

EliahKagan mentioned this pull request

Sep 7, 2023

Fix Windows environment variable upcasing bug #1650

Merged

otc-zuul Bot pushed a commit to opentelekomcloud-infra/eyes_on_docs that referenced this pull request

Sep 11, 2023


          Bump gitpython from 3.1.32 to 3.1.35 (#32)

0eef04a

Bump gitpython from 3.1.32 to 3.1.35

Bumps gitpython from 3.1.32 to 3.1.35.

Release notes
Sourced from gitpython's releases.

3.1.35 - a fix for CVE-2023-41040
What's Changed

Bump actions/checkout from 3 to 4 by @dependabot in gitpython-developers/GitPython#1643
Fix 'Tree' object has no attribute '_name' when submodule path is normal path by @CosmosAtlas in gitpython-developers/GitPython#1645
Fix CVE-2023-41040 by @facutuesca in gitpython-developers/GitPython#1644
Only make config more permissive in tests that need it by @EliahKagan in gitpython-developers/GitPython#1648
Added test for PR #1645 submodule path by @CosmosAtlas in gitpython-developers/GitPython#1647
Fix Windows environment variable upcasing bug by @EliahKagan in gitpython-developers/GitPython#1650

New Contributors

@CosmosAtlas made their first contribution in gitpython-developers/GitPython#1645
@facutuesca made their first contribution in gitpython-developers/GitPython#1644

Full Changelog: gitpython-developers/[email protected]
3.1.34 - fix resource leaking
What's Changed

util: close lockfile after opening successfully by @skshetry in gitpython-developers/GitPython#1639

New Contributors

@skshetry made their first contribution in gitpython-developers/GitPython#1639

Full Changelog: gitpython-developers/[email protected]
v3.1.33 - with security fix
What's Changed

WIP Quick doc by @LeoDaCoda in gitpython-developers/GitPython#1608
Partial clean up wrt mypy and black by @bodograumann in gitpython-developers/GitPython#1617
Disable merge_includes in config writers by @bodograumann in gitpython-developers/GitPython#1618
feat: full typing for "progress" parameter in Repo class by @madebylydia in gitpython-developers/GitPython#1634
Fix CVE-2023-40590 by @EliahKagan in gitpython-developers/GitPython#1636
#1566 Creating a lock now uses python built-in "open()" method to work arou… by @HageMaster3108 in gitpython-developers/GitPython#1619

New Contributors

@LeoDaCoda made their first contribution in gitpython-developers/GitPython#1608
@bodograumann made their first contribution in gitpython-developers/GitPython#1617
@EliahKagan made their first contribution in gitpython-developers/GitPython#1636
@HageMaster3108 made their first contribution in gitpython-developers/GitPython#1619

Full Changelog: gitpython-developers/[email protected]



Commits

c8e303f prepare next release
09e1b3d Merge pull request #1650 from EliahKagan/envcase
8017421 Merge pull request #1647 from CosmosAtlas/master
fafb4f6 updated docs to better describe testing procedure with new repo
9da24d4 add test for submodule path not owned by submodule case
eebdb25 Eliminate duplication of git.util.cwd logic
c7fad20 Fix Windows env var upcasing regression
7296e5c Make test helper script a file, for readability
d88372a Add test for Windows env var upcasing regression
11839ab Merge pull request #1648 from EliahKagan/file-protocol
Additional commits viewable in compare view




Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Reviewed-by: Vladimir Vshivkov

This was referenced Sep 13, 2023

Better document env_case test/fixture and cwd #1657

Merged

Improve Python version and OS compatibility, fixing deprecations #1654

Merged

EliahKagan mentioned this pull request

Sep 26, 2023

Make clear every test's status in every CI run #1679

Merged

EliahKagan mentioned this pull request

Nov 4, 2023

Reorganize test_util and make xfail marks precise #1729

Merged

EliahKagan mentioned this pull request

Jan 10, 2024

Fix two remaining Windows untrusted search path cases #1792

Merged

0xMorph mentioned this pull request

Apr 28, 2026

Fix CVE-2023-40590 cantina-forks/GitPython-fix-review-demo#1

Open

Reviewers

Byron

Byron requested changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Milestone

v3.1.33 - Bugfixes

Development

Successfully merging this pull request may close these issues.

CVE-2023-40590: Untrusted search path on Windows systems leading to arbitrary code execution

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

EliahKagan commented Aug 30, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as resolved.

Byron commented Aug 30, 2023

Uh oh!

EliahKagan commented Aug 30, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

EliahKagan commented Aug 30, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Byron left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

xesf commented Aug 31, 2023

Uh oh!

EliahKagan commented Aug 31, 2023

Uh oh!

xesf commented Sep 1, 2023

Uh oh!

xesf commented Sep 7, 2023

Uh oh!

EliahKagan commented Sep 7, 2023

Uh oh!

xesf commented Sep 7, 2023

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

EliahKagan commented Aug 30, 2023 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

EliahKagan commented Aug 30, 2023 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

EliahKagan commented Aug 30, 2023 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.