GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-ffi-debugsourceUpgrade rubygem-oauth-ttyUpgrade rubygem-fast_gettextUpgrade rubygem-unfUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-little-pluggerUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-loggingUpgrade rubygem-mime-typesUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-gssapiUpgrade rubygem-http-acceptUpgrade satellite-cloneUpgrade rubygem-unicode-debuginfoUpgrade rubygem-snaky_hashUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-mime-types-dataUpgrade rubygem-multi_jsonUpgrade satellite-maintainUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-jwtUpgrade rubygem-localeUpgrade rubygem-oauthUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade rubygem-highlineUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffiUpgrade rubygem-domain_nameUpgrade python39-pulp_manifestUpgrade foreman-cliUpgrade satellite-cliUpgrade rubygem-powerbarUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade rubygem-clampUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_ansible | Nov 1, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade python-git | Aug 14, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade rubygem-hashieUpgrade rubygem-clampUpgrade foreman-cliUpgrade rubygem-oauthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-rest-clientUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highlineUpgrade rubygem-unicode-display_widthUpgrade rubygem-foreman_maintainUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-mime-types-dataUpgrade rubygem-domain_nameUpgrade rubygem-powerbarUpgrade satellite-cloneUpgrade rubygem-oauth-ttyUpgrade rubygem-apipie-bindingsUpgrade rubygem-ffi-debuginfoUpgrade rubygem-jwtUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-localeUpgrade rubygem-http-acceptUpgrade rubygem-fast_gettextUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-version_gemUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unf_extUpgrade rubygem-unicodeUpgrade rubygem-multi_jsonUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-amazing_printUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade python39-pulp_manifestUpgrade rubygem-snaky_hashUpgrade rubygem-netrcUpgrade rubygem-gssapiUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_templates | Nov 1, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfo | Mar 5, 2024 | Aug 11, 2023 |
| Ubuntu | — | Upgrade python3-gitUpgrade python-git (Ubuntu Pro)Upgrade python3-git (Ubuntu Pro) | Sep 5, 2023 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub