GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-little-pluggerUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debugsourceUpgrade rubygem-mime-typesUpgrade rubygem-loggingUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-amazing_printUpgrade rubygem-mime-types-dataUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cliUpgrade rubygem-apipie-bindingsUpgrade satellite-maintainUpgrade rubygem-multi_jsonUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffi-debuginfoUpgrade satellite-cloneUpgrade rubygem-gssapiUpgrade rubygem-unicode-debuginfoUpgrade rubygem-domain_nameUpgrade foreman-cliUpgrade rubygem-hashieUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-display_widthUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-netrcUpgrade rubygem-unf_extUpgrade rubygem-ffiUpgrade satellite-cliUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-rest-clientUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-foreman_maintainUpgrade rubygem-clampUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_bootdisk | Nov 1, 2023 | Aug 11, 2023 |
| Debian | — | Upgrade python-git | Aug 14, 2023 | Aug 11, 2023 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cloneUpgrade rubygem-hammer_cliUpgrade rubygem-hashieUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-display_widthUpgrade rubygem-little-pluggerUpgrade rubygem-clampUpgrade rubygem-oauthUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-highlineUpgrade foreman-cliUpgrade rubygem-domain_nameUpgrade rubygem-apipie-bindingsUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-foreman_maintainUpgrade rubygem-rest-clientUpgrade rubygem-powerbarUpgrade rubygem-mime-types-dataUpgrade rubygem-unfUpgrade rubygem-ffiUpgrade rubygem-snaky_hashUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unf_extUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-ffi-debuginfoUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-localeUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unicodeUpgrade rubygem-jwtUpgrade rubygem-mime-typesUpgrade rubygem-http-cookieUpgrade rubygem-multi_jsonUpgrade satellite-cliUpgrade rubygem-gssapiUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-version_gemUpgrade rubygem-ffi-debugsource | Nov 1, 2023 | Aug 11, 2023 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsource | Mar 5, 2024 | Aug 11, 2023 |
| Ubuntu | — | Upgrade python3-gitUpgrade python-git (Ubuntu Pro)Upgrade python3-git (Ubuntu Pro) | Sep 5, 2023 | Aug 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub