GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade satellite-cliUpgrade rubygem-powerbarUpgrade rubygem-unf_extUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffiUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade foreman-cliUpgrade rubygem-oauthUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-foreman_maintainUpgrade rubygem-highlineUpgrade rubygem-netrcUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-version_gemUpgrade rubygem-http-cookieUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-rest-clientUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unfUpgrade rubygem-unicode-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-fast_gettextUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-amazing_printUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-ffi-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-mime-types-dataUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cliUpgrade rubygem-jwtUpgrade rubygem-oauth-ttyUpgrade satellite-maintainUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicodeUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade satellite-cloneUpgrade rubygem-gssapiUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffi-debuginfo | Nov 1, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade python-git | Aug 14, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade rubygem-domain_nameUpgrade rubygem-unicode-display_widthUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_googleUpgrade foreman-cliUpgrade rubygem-little-pluggerUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-mime-types-dataUpgrade rubygem-unfUpgrade rubygem-foreman_maintainUpgrade rubygem-apipie-bindingsUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-oauthUpgrade satellite-cloneUpgrade rubygem-hashieUpgrade rubygem-hammer_cliUpgrade rubygem-clampUpgrade rubygem-powerbarUpgrade rubygem-highlineUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-loggingUpgrade rubygem-fast_gettextUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-amazing_printUpgrade rubygem-snaky_hashUpgrade satellite-cliUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-ffi-debugsourceUpgrade rubygem-http-cookieUpgrade rubygem-multi_jsonUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-unicodeUpgrade satellite-maintainUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-ffi-debuginfoUpgrade rubygem-netrcUpgrade rubygem-version_gemUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-mime-types | Nov 1, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfo | Mar 5, 2024 | Aug 11, 2023 |
| Ubuntu | — | Upgrade python3-git (Ubuntu Pro)Upgrade python3-gitUpgrade python-git (Ubuntu Pro) | Sep 5, 2023 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub