CVE-2023-40267

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.

Database specific

{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40267.json"
}

References

Affected packages

Git / github.com/gitpython-developers/gitpython

Affected ranges

Type

GIT

Repo

https://github.com/gitpython-developers/gitpython

Events

Introduced

Fixed

5d45ce243a12669724e969442e6725a894e30fd4

Fixed

ca965ecc81853bca7675261729143f54e5bf4cdd

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "3.1.32"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "ca965ecc81853bca7675261729143f54e5bf4cdd"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*

0.1.4

0.1.4-pre

0.1.5

0.1.6

0.2.0-beta1

0.3.0-beta1

0.3.0-beta2

0.3.1-beta1

0.3.1-beta2

0.3.2

0.3.2-RC1

0.3.2.1

0.3.3

0.3.4

0.3.5

0.3.6

0.3.7

1.*

1.0.0

1.0.1

1.0.2

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.1.0

2.1.1

2.1.10

2.1.11

2.1.12

2.1.13

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.8

2.1.9

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.0.6

3.0.7

3.0.8

3.0.9

3.1.0

3.1.1

3.1.10

3.1.11

3.1.12

3.1.13

3.1.16

3.1.17

3.1.18

3.1.19

3.1.2

3.1.20

3.1.22

3.1.23

3.1.24

3.1.25

3.1.26

3.1.27

3.1.28

3.1.29

3.1.3

3.1.30

3.1.31

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

Other

winerr_show

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40267.json"