GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade foreman-cliUpgrade rubygem-domain_nameUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-http-cookieUpgrade rubygem-hashieUpgrade rubygem-oauthUpgrade rubygem-unf_extUpgrade satellite-cliUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-powerbarUpgrade rubygem-clampUpgrade rubygem-highlineUpgrade rubygem-netrcUpgrade python39-pulp_manifestUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-rest-clientUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-ffi-debugsourceUpgrade rubygem-jwtUpgrade rubygem-little-pluggerUpgrade rubygem-unfUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-amazing_printUpgrade rubygem-fast_gettextUpgrade rubygem-unicode-debuginfoUpgrade satellite-cloneUpgrade rubygem-gssapiUpgrade rubygem-http-acceptUpgrade rubygem-loggingUpgrade rubygem-unicodeUpgrade rubygem-mime-typesUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-ffi-debuginfoUpgrade rubygem-mime-types-dataUpgrade satellite-maintainUpgrade rubygem-multi_jsonUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-apipie-bindings | Nov 1, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade python-git | Aug 14, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade rubygem-powerbarUpgrade rubygem-rest-clientUpgrade rubygem-highlineUpgrade rubygem-oauth-ttyUpgrade rubygem-little-pluggerUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-foreman_maintainUpgrade rubygem-apipie-bindingsUpgrade rubygem-oauthUpgrade satellite-cloneUpgrade rubygem-hammer_cliUpgrade rubygem-clampUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hashieUpgrade rubygem-unfUpgrade rubygem-domain_nameUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffi-debugsourceUpgrade rubygem-loggingUpgrade rubygem-version_gemUpgrade rubygem-unicodeUpgrade rubygem-http-cookieUpgrade rubygem-multi_jsonUpgrade rubygem-jwtUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-amazing_printUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-localeUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffiUpgrade satellite-maintainUpgrade rubygem-gssapiUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-snaky_hashUpgrade rubygem-fast_gettextUpgrade rubygem-unf_ext | Nov 1, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-utils-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsource | Mar 5, 2024 | Aug 11, 2023 |
| Ubuntu | — | Upgrade python-git (Ubuntu Pro)Upgrade python3-gitUpgrade python3-git (Ubuntu Pro) | Sep 5, 2023 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub