PYSEC-2023-137
At a glance
- Published
- Updated
- CVE
- CVE-2023-40267
- Aliases
- GHSA-pr76-5cm5-w9cj
Description
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.
Affected packages
| Package | Versions |
|---|---|
| PyPI · gitpython | introduced 0, fixed ca965ecc81853bca7675261729143f54e5bf4cdd ; introduced 0, fixed 3.1.32 |
References
- https://github.com/gitpython-developers/GitPython/commit/ca965ecc81853bca7675261729143f54e5bf4cdd FIX
- https://github.com/gitpython-developers/GitPython/pull/1609 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |